nathanmarz/storm · error

No password found for user

Error message

No password found for user: ${userName}

What it means

This is a WARN log in the DIGEST-MD5 SASL ServerCallbackHandler: when handling a NamePasswordCallback, no password was found in the configured credentials (digest authentication config) for the requesting user, so the callback's password is never set and authentication will fail. Storm resolves passwords from the digest authentication credentials map, or the 'super' user password via the storm.digest.authentication.super-password system property.

Solutions

1. Add the username and its password to the digest credentials config (digest authentication credentials map / file) on the server and restart the affected daemons/workers.
2. Verify the exact username string — digests are case-sensitive; check for typos or whitespace.
3. For the 'super' user, set the password via the documented system property on all nodes.
4. Check that all supervisors use the same credentials source (synced storm.yaml) — a config mismatch between nodes yields per-host failures.
5. Enable SASL/digest debug logging to confirm which username is being looked up and from which config.

Example fix

// before (storm.yaml server-side)
// credentials map has only: worker-transfer
// client connects as 'reader' -> No password found for user: reader
// after
storm.digest.authentication.credentials:
  - username: "reader"
    password: "reader-pass"
  - username: "worker-transfer"
    password: "transfer-pass"

// on the server, before starting nimbus/supervisors, confirm every client user has credentials
Map<String,String> creds = loadDigestCredentials();
for (String requiredUser : expectedUsers) {
    if (!creds.containsKey(requiredUser))
        throw new IllegalStateException("digest credentials missing for user: " + requiredUser);
}

When it happens

Trigger: handlePasswordCallback is invoked for a userName that is absent from the credentials map configured under storm's digest authentication config, and the userName is not 'super' with SYSPROP_SUPER_PASSWORD set — the password is never assigned.

Common situations: Client username missing from the server's credentials map in storm.yaml (or the credentials file shipped with the topology); typo in username; server config not updated/reloaded after adding users; worker nodes running stale config; missing -Dstorm.digest.authentication.super-password for the 'super' user.

Related errors

• configuration file could not be found
• Could not find a ' ' entry in this configuration.
• Could not find a ' ' entry in this configuration: Client…
• Could not find a ' ' entry in this configuration: Server…

AI-assisted analysis of nathanmarz/storm@cdb116e942 (2026-09-12). Data as JSON: /api/errors/b3bf970162e6bf3c. Report an issue: GitHub.

Appendix: source

Thrown at storm-core/src/jvm/backtype/storm/security/auth/digest/ServerCallbackHandler.java:99

            }
        }
    }

    private void handleNameCallback(NameCallback nc) {
        LOG.debug("handleNameCallback");
        userName = nc.getDefaultName();
        nc.setName(nc.getDefaultName());
    }

    private void handlePasswordCallback(PasswordCallback pc) {
        LOG.debug("handlePasswordCallback");
        if ("super".equals(this.userName) && System.getProperty(SYSPROP_SUPER_PASSWORD) != null) {
            // superuser: use Java system property for password, if available.
            pc.setPassword(System.getProperty(SYSPROP_SUPER_PASSWORD).toCharArray());
        } else if (credentials.containsKey(userName) ) {
            pc.setPassword(credentials.get(userName).toCharArray());
        } else {
            LOG.warn("No password found for user: " + userName);
        }
    }

    private void handleRealmCallback(RealmCallback rc) {
        LOG.debug("handleRealmCallback: "+ rc.getDefaultText());
        rc.setText(rc.getDefaultText());
    }

    private void handleAuthorizeCallback(AuthorizeCallback ac) {
        String authenticationID = ac.getAuthenticationID();
        LOG.debug("Successfully authenticated client: authenticationID=" + authenticationID);
        ac.setAuthorizedID(authenticationID);
        ac.setAuthorized(true);
    }
}

View on GitHub (pinned to cdb116e942)