{"record":{"id":"e793cd5b7c5b4e9a","repo":"apache/hadoop","slug":"unrecognized-sasl-client-callback","errorCode":null,"errorMessage":"Unrecognized SASL client callback ","messagePattern":"Unrecognized SASL client callback ","errorType":"exception","errorClass":"UnsupportedCallbackException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":694,"sourceCode":"      for (Callback callback : callbacks) {\n        if (callback instanceof RealmChoiceCallback) {\n          continue;\n        } else if (callback instanceof NameCallback) {\n          nc = (NameCallback) callback;\n        } else if (callback instanceof PasswordCallback) {\n          pc = (PasswordCallback) callback;\n        } else if (callback instanceof RealmCallback) {\n          rc = (RealmCallback) callback;\n        } else if (callback instanceof AuthorizeCallback) {\n          final AuthorizeCallback ac = (AuthorizeCallback) callback;\n          final String authId = ac.getAuthenticationID();\n          final String authzId = ac.getAuthorizationID();\n          ac.setAuthorized(authId.equals(authzId));\n          if (ac.isAuthorized()) {\n            ac.setAuthorizedID(authzId);\n          }\n        } else {\n          throw new UnsupportedCallbackException(callback,\n              \"Unrecognized SASL client callback \" + callback.getClass());\n        }\n      }\n      if (nc != null) {\n        if (LOG.isDebugEnabled())\n          LOG.debug(\"SASL client callback: setting username: \" + userName);\n        nc.setName(userName);\n      }\n      if (pc != null) {\n        if (LOG.isDebugEnabled())\n          LOG.debug(\"SASL client callback: setting userPassword\");\n        pc.setPassword(userPassword);\n      }\n      if (rc != null) {\n        if (LOG.isDebugEnabled())\n          LOG.debug(\"SASL client callback: setting realm: \"\n              + rc.getDefaultText());\n        rc.setText(rc.getDefaultText());","sourceCodeStart":676,"sourceCodeEnd":712,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L676-L712","documentation":"SaslRpcClient.AuthenticatorCallbackHandler only implements NameCallback, PasswordCallback, RealmCallback and AuthorizeCallback. When the JVM's SASL framework hands it any other Callback type (e.g. RealmChoiceCallback from a DIGEST-MD5 exchange), it throws UnsupportedCallbackException with this message. It signals that the negotiated SASL mechanism expects more from the client than Hadoop's handler was built to provide.","triggerScenarios":"Establishing an RPC connection where the negotiated mechanism emits a callback outside the four supported types: a DIGEST-MD5 (TOKEN auth) exchange where the JDK passes RealmChoiceCallback, or a custom/extra SASL mechanism registered in java.security that requests additional callbacks during Sasl.createSaslClient negotiation.","commonSituations":"Mismatched Hadoop client/server versions negotiating different mechanisms, a JVM with non-standard or third-party SASL providers, custom authentication plugins, or JDK upgrades that change which callbacks the SASL factories emit.","solutions":["Note the callback class named in the message and identify the mechanism in use (GSSAPI = KERBEROS, DIGEST-MD5 = TOKEN, PLAIN = SIMPLE over SASL)","Remove third-party SASL providers from the JVM security configuration so JDK defaults apply","Make client and server run compatible Hadoop versions with the same hadoop.security.authentication setting","If you control a custom SaslClientFactory, extend SaslRpcClient's callback handler to accept the missing callback type"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  proxy = RPC.getProtocolProxy(proto, addr, ticket, conf);\n} catch (IOException e) {\n  Throwable root = e;\n  while (root.getCause() != null) root = root.getCause();\n  if (root instanceof UnsupportedCallbackException) {\n    // unsupported SASL callback: check mechanism/provider setup, do not retry blindly\n    throw new SecurityException(\"SASL callback not supported: \" + root.getMessage(), e);\n  }\n  throw e;\n}","preventionTips":["Keep client and server Hadoop versions and hadoop.security.authentication settings identical","Do not register third-party SASL providers in the JVM security config","Re-test the full SASL handshake in staging after JDK or Hadoop upgrades"],"tags":["sasl","authentication","rpc","kerberos"],"backgroundTag":"sasl-callback-unsupported","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}