spring-projects/spring-security · error · UnsupportedCallbackException

Unknown Callback

Error message

Unknown Callback

What it means

KerberosRestTemplate's internal CallbackHandler supports only NameCallback and (when a password is configured) PasswordCallback, as required for the JAAS Krb5LoginModule. Any other JAAS callback type is rejected by throwing UnsupportedCallbackException with the message 'Unknown Callback'.

Solutions

1. Use the standard com.sun.security.auth.module.Krb5LoginModule, which only requires name/password callbacks.
2. If a custom LoginModule is required, restrict its callbacks to NameCallback/PasswordCallback.
3. Supply the password on KerberosRestTemplate so PasswordCallback can be answered (or use useTicketCache/keytab-based login).

Example fix

// before
KerberosRestTemplate t = new KerberosRestTemplate(customLoginConfigModule, user, pass);
// after
KerberosRestTemplate t = new KerberosRestTemplate(keytabPath, userPrincipal); // keytab-based, no exotic callbacks

// ensure only standard Krb5LoginModule is configured
boolean standard = "com.sun.security.auth.module.Krb5LoginModule".equals(loginModuleClassName);

try {
    return template.getForObject(url, String.class);
} catch (Exception e) {
    if (hasCause(e, UnsupportedCallbackException.class)) {
        // fall back to keytab-based template
    }
    throw e;
}

When it happens

Trigger: JAAS login configuration (ClientLoginConfig) uses a LoginModule that invokes a callback type other than name/password — e.g. a TextInputCallback, ChoiceCallback, or custom callback — while authenticating via KerberosRestTemplate's password-based login.

Common situations: Custom JAAS LoginModule implementations plugged in via the KerberosRestTemplate configuration; debugging setups where a prompt-based module asks for interactive callbacks.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Kerberos authentication failed
• credentials cannot be null
• doExecute returned null
• Error running rest call
• <ex.getMessage()>

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/80ecafe06db44e3e. Report an issue: GitHub.

Appendix: source

Thrown at kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java:362

			this.password = password;
		}

		@Override
		public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

			for (Callback callback : callbacks) {
				if (callback instanceof NameCallback) {
					NameCallback nc = (NameCallback) callback;
					nc.setName(this.userPrincipal);
				}
				else if (callback instanceof PasswordCallback) {
					PasswordCallback pc = (PasswordCallback) callback;
					if (this.password != null) {
						pc.setPassword(this.password.toCharArray());
					}
				}
				else {
					throw new UnsupportedCallbackException(callback, "Unknown Callback");
				}
			}
		}

	}

}

View on GitHub (pinned to 96852e8860)