provectus/kafka-ui · error · ValidationException

You specified username but do not specified password

Error message

You specified username but do not specified password

What it means

SchemaRegistrySerde builds a Confluent Schema Registry client. BASIC auth credentials must be supplied as a username+password pair; a username without a password cannot form the USER_INFO credential source, so ValidationException is thrown. The sibling check throws an analogous error for password-without-username.

Solutions

1. Set the password property/secret (schemaRegistryAuthPassword) alongside the username
2. If the registry truly needs no auth, remove the username too — both must be present or both absent
3. Check the deployment/secret mounts so both credential values actually reach the process

Example fix

// before
kafka:
  clusters:
    - schemaRegistryAuthUsername: admin
# after
kafka:
  clusters:
    - schemaRegistryAuthUsername: admin
      schemaRegistryAuthPassword: ${SR_PASSWORD}

if ((username == null) != (password == null)) { throw new IllegalArgumentException("schema registry auth requires both username and password (or neither)"); }

boolean srAuthComplete(String u, String p) { return (u == null) == (p == null); }

try { serde.autoConfigure(props); } catch (ValidationException e) { throw new ConfigurationException("Schema Registry credentials incomplete: " + e.getMessage()); }

When it happens

Trigger: createSchemaRegistryClient (via configure/autoConfigure) invoked with username != null and password == null — e.g. schemaRegistryAuthUsername set but schemaRegistryAuthPassword missing.

Common situations: Partial environment variable injection in deployments (username secret mounted, password secret missing); typos in the password property key; intentionally blank password in config.

Related errors

• OAuth2 authentication is enabled but no providers specified.
• Schema Registry is not set for cluster
• Application config isn't valid. Cluster names should be…
• Application config isn't valid. Two clusters can't have the…
• Invalid format for webclient.maxInMemoryBufferSize

AI-assisted analysis of provectus/kafka-ui@83b5a60cc0 (2026-09-08). Data as JSON: /api/errors/8357b58540e0d5cb. Report an issue: GitHub.

Appendix: source

Thrown at kafka-ui-api/src/main/java/com/provectus/kafka/ui/serdes/builtin/sr/SchemaRegistrySerde.java:145

    this.keySchemaNameTemplate = keySchemaNameTemplate;
    this.valueSchemaNameTemplate = valueSchemaNameTemplate;
    this.schemaRegistryFormatters = MessageFormatter.createMap(schemaRegistryClient);
    this.checkSchemaExistenceForDeserialize = checkTopicSchemaExistenceForDeserialize;
  }

  private static SchemaRegistryClient createSchemaRegistryClient(List<String> urls,
                                                                 @Nullable String username,
                                                                 @Nullable String password,
                                                                 @Nullable String keyStoreLocation,
                                                                 @Nullable String keyStorePassword,
                                                                 @Nullable String trustStoreLocation,
                                                                 @Nullable String trustStorePassword) {
    Map<String, String> configs = new HashMap<>();
    if (username != null && password != null) {
      configs.put(BASIC_AUTH_CREDENTIALS_SOURCE, "USER_INFO");
      configs.put(USER_INFO_CONFIG, username + ":" + password);
    } else if (username != null) {
      throw new ValidationException(
          "You specified username but do not specified password");
    } else if (password != null) {
      throw new ValidationException(
          "You specified password but do not specified username");
    }

    // We require at least a truststore. The logic is done similar to SchemaRegistryService.securedWebClientOnTLS
    if (trustStoreLocation != null && trustStorePassword != null) {
      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_TRUSTSTORE_LOCATION_CONFIG,
          trustStoreLocation);
      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_TRUSTSTORE_PASSWORD_CONFIG,
          trustStorePassword);
    }

    if (keyStoreLocation != null && keyStorePassword != null) {
      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_KEYSTORE_LOCATION_CONFIG,
          keyStoreLocation);
      configs.put(SchemaRegistryClientConfig.CLIENT_NAMESPACE + SslConfigs.SSL_KEYSTORE_PASSWORD_CONFIG,

View on GitHub (pinned to 83b5a60cc0)