The Hot Rod Java client configuration validator does not accept a configuration where the SASL callback handler is not set. However, if a valid client Subject is supplied instead, the validator accepts the configuration. As a result, the configuration validator throws a org.infinispan.commons.CacheConfigurationException exception with the following error message: ISPN004030: Cannot enable authentication without specifying a Callback Handler. A workaround for this issue is to supply a callbackhandler with an empty handle() method as follows: public static final class NoOpCallbackHandler implements CallbackHandler { public static final NoOpCallbackHandler INSTANCE = new NoOpCallbackHandler(); @Override public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException { // NO OP } } As a result, the configuration validator accepts the configuration and SASL authentication works as expected.