{"record":{"id":"b3bf970162e6bf3c","repo":"nathanmarz/storm","slug":"no-password-found-for-user-username","errorCode":null,"errorMessage":"No password found for user: ${userName}","messagePattern":"No password found for user: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"storm-core/src/jvm/backtype/storm/security/auth/digest/ServerCallbackHandler.java","lineNumber":99,"sourceCode":"            }\n        }\n    }\n\n    private void handleNameCallback(NameCallback nc) {\n        LOG.debug(\"handleNameCallback\");\n        userName = nc.getDefaultName();\n        nc.setName(nc.getDefaultName());\n    }\n\n    private void handlePasswordCallback(PasswordCallback pc) {\n        LOG.debug(\"handlePasswordCallback\");\n        if (\"super\".equals(this.userName) && System.getProperty(SYSPROP_SUPER_PASSWORD) != null) {\n            // superuser: use Java system property for password, if available.\n            pc.setPassword(System.getProperty(SYSPROP_SUPER_PASSWORD).toCharArray());\n        } else if (credentials.containsKey(userName) ) {\n            pc.setPassword(credentials.get(userName).toCharArray());\n        } else {\n            LOG.warn(\"No password found for user: \" + userName);\n        }\n    }\n\n    private void handleRealmCallback(RealmCallback rc) {\n        LOG.debug(\"handleRealmCallback: \"+ rc.getDefaultText());\n        rc.setText(rc.getDefaultText());\n    }\n\n    private void handleAuthorizeCallback(AuthorizeCallback ac) {\n        String authenticationID = ac.getAuthenticationID();\n        LOG.debug(\"Successfully authenticated client: authenticationID=\" + authenticationID);\n        ac.setAuthorizedID(authenticationID);\n        ac.setAuthorized(true);\n    }\n}\n","sourceCodeStart":81,"sourceCodeEnd":115,"githubUrl":"https://github.com/nathanmarz/storm/blob/cdb116e942666973bc4eaa0df098d5bab82739e7/storm-core/src/jvm/backtype/storm/security/auth/digest/ServerCallbackHandler.java#L81-L115","documentation":"This is a WARN log in the DIGEST-MD5 SASL ServerCallbackHandler: when handling a NamePasswordCallback, no password was found in the configured credentials (digest authentication config) for the requesting user, so the callback's password is never set and authentication will fail. Storm resolves passwords from the digest authentication credentials map, or the 'super' user password via the storm.digest.authentication.super-password system property.","triggerScenarios":"handlePasswordCallback is invoked for a userName that is absent from the credentials map configured under storm's digest authentication config, and the userName is not 'super' with SYSPROP_SUPER_PASSWORD set — the password is never assigned.","commonSituations":"Client username missing from the server's credentials map in storm.yaml (or the credentials file shipped with the topology); typo in username; server config not updated/reloaded after adding users; worker nodes running stale config; missing -Dstorm.digest.authentication.super-password for the 'super' user.","solutions":["Add the username and its password to the digest credentials config (digest authentication credentials map / file) on the server and restart the affected daemons/workers.","Verify the exact username string — digests are case-sensitive; check for typos or whitespace.","For the 'super' user, set the password via the documented system property on all nodes.","Check that all supervisors use the same credentials source (synced storm.yaml) — a config mismatch between nodes yields per-host failures.","Enable SASL/digest debug logging to confirm which username is being looked up and from which config."],"exampleFix":"// before (storm.yaml server-side)\n// credentials map has only: worker-transfer\n// client connects as 'reader' -> No password found for user: reader\n// after\nstorm.digest.authentication.credentials:\n  - username: \"reader\"\n    password: \"reader-pass\"\n  - username: \"worker-transfer\"\n    password: \"transfer-pass\"","handlingStrategy":"validation","validationCode":"// on the server, before starting nimbus/supervisors, confirm every client user has credentials\nMap<String,String> creds = loadDigestCredentials();\nfor (String requiredUser : expectedUsers) {\n    if (!creds.containsKey(requiredUser))\n        throw new IllegalStateException(\"digest credentials missing for user: \" + requiredUser);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the digest credentials map in storm.yaml identical and synced on every node.","Use the 'super' user system property only for the superuser, configured on all hosts.","Rotate/add users through config management so credentials never drift between nodes.","Validate client username strings (no typos, no whitespace) before deployment."],"tags":["security","authentication","digest","sasl","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"cdb116e942666973bc4eaa0df098d5bab82739e7","analyzedAt":"2026-09-12T14:30:00.714Z","contentChangedAt":"2026-09-12T14:30:00.714Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}