{"record":{"id":"8998e1798ea49712","repo":"apache/hadoop","slug":"unrecognized-sasl-gssapi-callback","errorCode":null,"errorMessage":"Unrecognized SASL GSSAPI Callback","messagePattern":"Unrecognized SASL GSSAPI Callback","errorType":"exception","errorClass":"UnsupportedCallbackException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java","lineNumber":381,"sourceCode":"        final char[] password = name != null ? getPassword(name) : null;\n        customizedCallbackHandler.handleCallbacks(unknownCallbacks, name, password);\n      }\n    }\n  }\n\n  /** CallbackHandler for SASL GSSAPI Kerberos mechanism */\n  @InterfaceStability.Evolving\n  public static class SaslGssCallbackHandler implements CallbackHandler {\n\n    @Override\n    public void handle(Callback[] callbacks) throws\n        UnsupportedCallbackException {\n      AuthorizeCallback ac = null;\n      for (Callback callback : callbacks) {\n        if (callback instanceof AuthorizeCallback) {\n          ac = (AuthorizeCallback) callback;\n        } else {\n          throw new UnsupportedCallbackException(callback,\n              \"Unrecognized SASL GSSAPI Callback\");\n        }\n      }\n      if (ac != null) {\n        String authid = ac.getAuthenticationID();\n        String authzid = ac.getAuthorizationID();\n        if (authid.equals(authzid)) {\n          ac.setAuthorized(true);\n        } else {\n          ac.setAuthorized(false);\n        }\n        if (ac.isAuthorized()) {\n          if (LOG.isDebugEnabled())\n            LOG.debug(\"SASL server GSSAPI callback: setting \"\n                + \"canonicalized client ID: \" + authzid);\n          ac.setAuthorizedID(authzid);\n        }\n      }","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java#L363-L399","documentation":"SaslGssCallbackHandler, the server-side Kerberos callback handler, accepts only AuthorizeCallback and throws UnsupportedCallbackException for anything else. The JDK's GSS-API normally sends exactly one AuthorizeCallback during SASL GSSAPI negotiation, so this message points to an unusual GSS implementation or an injected provider rather than ordinary configuration.","triggerScenarios":"A JVM or JAAS login module whose GSS layer emits additional callback types during SASL GSSAPI negotiation on the server side of an RPC connection.","commonSituations":"Non-OpenJDK JVMs (e.g. older IBM J9 builds), custom JAAS login modules configured through java.security.auth.login.config, or JVM hardening that swaps the default GSS provider.","solutions":["Identify the callback class named in the exception and which GSS provider sent it","Switch the affected node to a stock OpenJDK distribution and retest the handshake","Remove custom JAAS/GSS modules from the login configuration","Align Hadoop and JDK versions across client and server nodes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  saslServer = SaslRpcServer.create(connection, props, secretManager);\n} catch (IOException e) {\n  if (e.getCause() instanceof UnsupportedCallbackException) {\n    // log callback class and JVM GSS provider details; fail handshake cleanly\n  }\n  throw e;\n}","preventionTips":["Standardize cluster JVMs on one OpenJDK distribution","Avoid custom JAAS/GSS login modules unless strictly required","Monitor SASL handshake failure rates to catch provider regressions early"],"tags":["sasl","kerberos","gssapi","server"],"backgroundTag":"sasl-callback-unsupported","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}