spring-projects/spring-security · error · UnsupportedCallbackException

Unknown Callback

Error message

Unknown Callback

What it means

KerberosRestTemplate's internal CallbackHandler supports only NameCallback and (when a password is configured) PasswordCallback, as required for the JAAS Krb5LoginModule. Any other JAAS callback type is rejected by throwing UnsupportedCallbackException with the message 'Unknown Callback'.

Source

Thrown at kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java:362

			this.password = password;
		}

		@Override
		public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {

			for (Callback callback : callbacks) {
				if (callback instanceof NameCallback) {
					NameCallback nc = (NameCallback) callback;
					nc.setName(this.userPrincipal);
				}
				else if (callback instanceof PasswordCallback) {
					PasswordCallback pc = (PasswordCallback) callback;
					if (this.password != null) {
						pc.setPassword(this.password.toCharArray());
					}
				}
				else {
					throw new UnsupportedCallbackException(callback, "Unknown Callback");
				}
			}
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Use the standard com.sun.security.auth.module.Krb5LoginModule, which only requires name/password callbacks.
2. If a custom LoginModule is required, restrict its callbacks to NameCallback/PasswordCallback.
3. Supply the password on KerberosRestTemplate so PasswordCallback can be answered (or use useTicketCache/keytab-based login).

Example fix

// before
KerberosRestTemplate t = new KerberosRestTemplate(customLoginConfigModule, user, pass);
// after
KerberosRestTemplate t = new KerberosRestTemplate(keytabPath, userPrincipal); // keytab-based, no exotic callbacks

// ensure only standard Krb5LoginModule is configured
boolean standard = "com.sun.security.auth.module.Krb5LoginModule".equals(loginModuleClassName);

try {
    return template.getForObject(url, String.class);
} catch (Exception e) {
    if (hasCause(e, UnsupportedCallbackException.class)) {
        // fall back to keytab-based template
    }
    throw e;
}

When it happens

Trigger: JAAS login configuration (ClientLoginConfig) uses a LoginModule that invokes a callback type other than name/password — e.g. a TextInputCallback, ChoiceCallback, or custom callback — while authenticating via KerberosRestTemplate's password-based login.

Common situations: Custom JAAS LoginModule implementations plugged in via the KerberosRestTemplate configuration; debugging setups where a prompt-based module asks for interactive callbacks.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Kerberos authentication failed
• Error running rest call
• doExecute returned null
• credentials cannot be null
• username cannot be null

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/80ecafe06db44e3e. Report an issue: GitHub.