What causes "You specified password but did not specify username" in provectus/kafka-ui?

Add the matching username property next to the password in the cluster config

provectus/kafka-ui · error · ValidationException

You specified password but did not specify username

Error message

You specified password but did not specify username

What it means

The symmetric case of configureBasicAuth(): a password without a username cannot form HTTP basic credentials, so WebClientConfigurator throws this ValidationException when configureBasicAuth(username=null, password!=null) is called while setting up a WebClient.

Solutions

Add the matching username property next to the password in the cluster config
Verify the secret/env interpolation for the username key resolves to a non-empty value
Restart kafka-ui after the config fix

Example fix

// before
schemaRegistry:
  basicAuthPassword: ${SR_PASSWORD}
// after
schemaRegistry:
  basicAuthUsername: ${SR_USERNAME}
  basicAuthPassword: ${SR_PASSWORD}

Defensive patterns

Strategy: validation

Validate before calling

if (password != null && username == null) {
  throw new IllegalArgumentException("basicAuthPassword set but basicAuthUsername missing");
}

Type guard

boolean hasCompleteBasicAuth(String u, String p) { return u != null && p != null; }

Try / catch

try {
  webClient = configurator.configureBasicAuth(user, pass).build();
} catch (ValidationException e) {
  log.error("Incomplete basic auth config: {}", e.getMessage());
}

Prevention

Group credential pairs in a single secret to prevent partial renders
Assert both keys exist when mounting secrets
Review example configs for both fields before copying

When it happens

Trigger: Cluster properties set basicAuthPassword for connect/schemaRegistry (or similar) but the corresponding username is missing or empty when the WebClient is configured.

Common situations: Username stored in a secret whose key was renamed; config example showing only the password; variable interpolation producing an empty username string.

Related errors

AI-assisted analysis of provectus/kafka-ui@83b5a60cc0 (2026-09-08). Data as JSON: /api/errors/5787ade192ae9048. Report an issue: GitHub.

Appendix: source

Thrown at kafka-ui-api/src/main/java/com/provectus/kafka/ui/util/WebClientConfigurator.java:106

      KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
      keyManagerFactory.init(keyStore, keystorePassword.toCharArray());
      contextBuilder.keyManager(keyManagerFactory);
    }

    // Create webclient
    SslContext context = contextBuilder.build();

    httpClient = httpClient.secure(t -> t.sslContext(context));
    return this;
  }

  public WebClientConfigurator configureBasicAuth(@Nullable String username, @Nullable String password) {
    if (username != null && password != null) {
      builder.defaultHeaders(httpHeaders -> httpHeaders.setBasicAuth(username, password));
    } else if (username != null) {
      throw new ValidationException("You specified username but did not specify password");
    } else if (password != null) {
      throw new ValidationException("You specified password but did not specify username");
    }
    return this;
  }

  public WebClientConfigurator configureBufferSize(DataSize maxBuffSize) {
    builder.codecs(c -> c.defaultCodecs().maxInMemorySize((int) maxBuffSize.toBytes()));
    return this;
  }

  public WebClientConfigurator configureObjectMapper(ObjectMapper mapper) {
    builder.codecs(codecs -> {
      codecs.defaultCodecs()
          .jackson2JsonEncoder(new Jackson2JsonEncoder(mapper, MediaType.APPLICATION_JSON));
      codecs.defaultCodecs()
          .jackson2JsonDecoder(new Jackson2JsonDecoder(mapper, MediaType.APPLICATION_JSON));
    });
    return this;
  }

View on GitHub (pinned to 83b5a60cc0)