provectus/kafka-ui · error · ValidationException

You specified username but did not specify password

Error message

You specified username but did not specify password

What it means

WebClientConfigurator.configureBasicAuth() builds HTTP basic-auth for outgoing WebClients (e.g. Kafka Connect or schema registry clients). Basic auth needs both a username and password; if only a username is supplied it throws this ValidationException rather than sending incomplete credentials.

Solutions

1. Provide the matching password property alongside the username in the cluster config
2. Check secret/env templating: the password env var or mounted key must exist and be non-empty at startup
3. Restart kafka-ui after adding the missing value

Example fix

// before
kafka:
  clusters:
    - name: local
      schemaRegistry:
        basicAuthUsername: admin
// after
kafka:
  clusters:
    - name: local
      schemaRegistry:
        basicAuthUsername: admin
        basicAuthPassword: ${SR_PASSWORD}

if (username != null && password == null) {
  throw new IllegalArgumentException("basicAuthUsername set but basicAuthPassword missing");
}

boolean hasCompleteBasicAuth(String u, String p) { return u != null && p != null; }

try {
  webClient = configurator.configureBasicAuth(user, pass).build();
} catch (ValidationException e) {
  log.error("Incomplete basic auth config: {}", e.getMessage());
}

When it happens

Trigger: Cluster properties define `connect`/`schemaRegistry` basicAuthUsername (or username) without the matching basicAuthPassword, when a client for that service is built.

Common situations: Secret templating where the password key failed to render (empty value trimmed to null); copying an example config and omitting the password; password supplied via env var that wasn't set in the deployment.

Related errors

• You specified password but did not specify username
• Invalid format for webclient.maxInMemoryBufferSize
• Application config isn't valid. Cluster names should be…
• Application config isn't valid. Two clusters can't have the…
• OAuth2 authentication is enabled but no providers specified.

AI-assisted analysis of provectus/kafka-ui@83b5a60cc0 (2026-09-08). Data as JSON: /api/errors/917983d29f8f4d56. Report an issue: GitHub.

Appendix: source

Thrown at kafka-ui-api/src/main/java/com/provectus/kafka/ui/util/WebClientConfigurator.java:104

      );

      KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
      keyManagerFactory.init(keyStore, keystorePassword.toCharArray());
      contextBuilder.keyManager(keyManagerFactory);
    }

    // Create webclient
    SslContext context = contextBuilder.build();

    httpClient = httpClient.secure(t -> t.sslContext(context));
    return this;
  }

  public WebClientConfigurator configureBasicAuth(@Nullable String username, @Nullable String password) {
    if (username != null && password != null) {
      builder.defaultHeaders(httpHeaders -> httpHeaders.setBasicAuth(username, password));
    } else if (username != null) {
      throw new ValidationException("You specified username but did not specify password");
    } else if (password != null) {
      throw new ValidationException("You specified password but did not specify username");
    }
    return this;
  }

  public WebClientConfigurator configureBufferSize(DataSize maxBuffSize) {
    builder.codecs(c -> c.defaultCodecs().maxInMemorySize((int) maxBuffSize.toBytes()));
    return this;
  }

  public WebClientConfigurator configureObjectMapper(ObjectMapper mapper) {
    builder.codecs(codecs -> {
      codecs.defaultCodecs()
          .jackson2JsonEncoder(new Jackson2JsonEncoder(mapper, MediaType.APPLICATION_JSON));
      codecs.defaultCodecs()
          .jackson2JsonDecoder(new Jackson2JsonDecoder(mapper, MediaType.APPLICATION_JSON));
    });

View on GitHub (pinned to 83b5a60cc0)