apache/druid · error · IllegalStateException

Failed to authenticate user principal

Error message

Failed to authenticate user principal [%s] with keytab [%s]

What it means

Kerberos authentication failure in HiveIcebergCatalog.authenticate(): when Hadoop security is enabled and a principal/keytab pair is configured, the UserGroupInformation login for that principal from the given keytab failed (wrong principal/keytab pair, missing or unreadable keytab file, or KDC rejection). The catalog cannot access Hive Metastore-backed iceberg tables without valid credentials.

Solutions

1. Verify the principal exists in the KDC and matches the keytab entries (klist -kt).
2. Check the keytab file path, its readability by the Druid process, and krb5.conf/realm settings.

When it happens

Trigger: Thrown at extensions-contrib/druid-iceberg-extensions/src/main/java/org/apache/druid/iceberg/input/HiveIcebergCatalog.java:124 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/6ea5197ef5dc03b5. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/druid-iceberg-extensions/src/main/java/org/apache/druid/iceberg/input/HiveIcebergCatalog.java:124

    return catalog;
  }

  private void authenticate()
  {
    String principal = catalogProperties.getOrDefault("principal", null);
    String keytab = catalogProperties.getOrDefault("keytab", null);
    if (!Strings.isNullOrEmpty(principal) && !Strings.isNullOrEmpty(keytab)) {
      UserGroupInformation.setConfiguration(configuration);
      if (UserGroupInformation.isSecurityEnabled()) {
        try {
          if (UserGroupInformation.getCurrentUser().hasKerberosCredentials() == false
              || !UserGroupInformation.getCurrentUser().getUserName().equals(principal)) {
            log.info("Hive trying to authenticate user [%s] with keytab [%s]..", principal, keytab);
            UserGroupInformation.loginUserFromKeytab(principal, keytab);
          }
        }
        catch (IOException e) {
          throw new ISE(e, "Failed to authenticate user principal [%s] with keytab [%s]", principal, keytab);
        }
      }
    }
  }

  public String getWarehousePath()
  {
    return warehousePath;
  }

  public String getCatalogUri()
  {
    return catalogUri;
  }

  public Map<String, String> getCatalogProperties()
  {
    return catalogProperties;

View on GitHub (pinned to 9b90983fd2)