apache/druid · error

Failed to login as [%s]

Error message

Failed to login as [%s]

What it means

DruidKerberosAuthenticationHandler.init() performs a JAAS LoginContext.login() for the server subject using the SPNEGO principal. If Kerberos login fails (LoginException), it logs this warning and throws an AuthenticationException, so the authentication handler fails to initialize. Typical root causes: missing/bad keytab, wrong principal, stale ticket, or broken krb5/JAAS configuration.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java:117

        spnegoPrincipals = new String[]{principal};
      }

      String nameRules = config.getProperty(NAME_RULES, null);
      if (nameRules != null) {
        KerberosName.setRules(nameRules);
      }

      for (String spnegoPrincipal : spnegoPrincipals) {
        log.info("Login using keytab %s, for principal %s", keytab, spnegoPrincipal);
        final KerberosAuthenticator.DruidKerberosConfiguration kerberosConfiguration =
            new KerberosAuthenticator.DruidKerberosConfiguration(keytab, spnegoPrincipal);
        final LoginContext loginContext =
            new LoginContext("", serverSubject, null, kerberosConfiguration);
        try {
          loginContext.login();
        }
        catch (LoginException le) {
          log.warn(le, "Failed to login as [%s]", spnegoPrincipal);
          throw new AuthenticationException(le);
        }
        loginContexts.add(loginContext);
      }
      try {
        gssManager = Subject.doAs(serverSubject, new PrivilegedExceptionAction<>()
        {

          @Override
          public GSSManager run()
          {
            return GSSManager.getInstance();
          }
        });
      }
      catch (PrivilegedActionException ex) {
        throw ex.getException();
      }

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Verify the principal in the keytab: run `klist -kt /path/to/keytab` and confirm it contains the spnegoPrincipal exactly (realm case included).
2. Check file permissions/readability of the keytab and krb5.conf for the Druid process user.
3. Regenerate the keytab from the KDC if `kinit -kt keytab principal` also fails.
4. Fix druid.auth.kerberos config properties (principal, keytab path) to match the KDC entries.

Example fix

// before
// druid.auth.kerberos.principal = HTTP/_HOST@WRONG.REALM
// after
// druid.auth.kerberos.principal = HTTP/host.example.com@EXAMPLE.COM
// druid.auth.kerberos.keytab = /etc/security/keytabs/spnego.service.keytab

# pre-flight before starting Druid
kinit -kt /etc/security/keytabs/spnego.service.keytab HTTP/host.example.com@EXAMPLE.COM || echo "keytab/principal invalid"

try { new LoginContext("", serverSubject, null, kerberosConfiguration).login(); }
catch (LoginException le) { throw new IllegalStateException("Check keytab/principal: " + le.getMessage(), le); }

When it happens

Trigger: init() runs loginContext.login() with kerberosConfiguration; thrown when the spnegoPrincipal cannot authenticate: keytab file missing or unreadable, principal not present in keytab, unsupported/faulty encryption types, invalid krb5.conf, expired credentials.

Common situations: Wrong druid.auth.kerberos.principal/server config vs. actual keytab entries; keytab not deployed or wrong permissions on the node; ktutil/kadmin keytab regenerated without redeploy; KDC unreachable or DNS/realm misconfiguration.

Related errors

• Principals do not exist in the keytab
• AuthenticationToken ignored:
• Authentication exception:
• The gRPC query server requires either a Basic or Anonymous a
• Either set 'key' or 'sharedAccessStorageToken' or 'useAzureC

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/c5a09f1371034d2c. Report an issue: GitHub.