apache/druid · critical · ServletException

Keytab does not exist:

Error message

Keytab does not exist: 

What it means

After principal and keytab-path config checks pass, initializeKerberosLogin verifies the keytab file actually exists on disk. A missing file aborts the JAAS server login with a ServletException carrying the path, thrown during doFilter initialization.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java:508

          )
      };
    }
  }

  private void initializeKerberosLogin() throws ServletException
  {
    String keytab;

    try {
      if (serverPrincipal == null || serverPrincipal.trim().length() == 0) {
        throw new ServletException("Principal not defined in configuration");
      }
      keytab = serverKeytab;
      if (keytab == null || keytab.trim().length() == 0) {
        throw new ServletException("Keytab not defined in configuration");
      }
      if (!new File(keytab).exists()) {
        throw new ServletException("Keytab does not exist: " + keytab);
      }

      Set<Principal> principals = new HashSet<>();
      principals.add(new KerberosPrincipal(serverPrincipal));
      Subject subject = new Subject(false, principals, new HashSet<>(), new HashSet<>());

      DruidKerberosConfiguration kerberosConfiguration = new DruidKerberosConfiguration(keytab, serverPrincipal);

      log.info("Login using keytab " + keytab + ", for principal " + serverPrincipal);
      loginContext = new LoginContext("", subject, null, kerberosConfiguration);
      loginContext.login();

      log.info("Initialized, principal %s from keytab %s", serverPrincipal, keytab);
    }
    catch (Exception ex) {
      throw new ServletException(ex);
    }
  }

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Deploy the keytab to the exact configured path on every node (or mount it in containers)
2. Fix druid.auth.kerberos.serverKeytab to the real path (use _HOST substitution patterns where supported)
3. Check mount/permissions so the druid process can access the file
4. Regenerate the keytab with kadmin ktadd if it was lost during rotation

Example fix

// before
props.setProperty("druid.auth.kerberos.serverKeytab", "/etc/security/keytabs/http.keytab"); // not present in container
// after
// mount keytab and set:
props.setProperty("druid.auth.kerberos.serverKeytab", "/etc/security/keytabs/http_$(hostname -f).keytab");

String keytab = props.getProperty("druid.auth.kerberos.serverKeytab");
java.io.File f = new java.io.File(keytab);
if (!f.exists() || !f.canRead()) {
  throw new IllegalStateException("Keytab missing or unreadable on this host: " + keytab);
}

try {
  authenticator.init(config);
} catch (ServletException e) {
  if (e.getMessage().startsWith("Keytab does not exist")) { log.error("Deploy keytab: {}", e.getMessage()); }
  throw e;
}

When it happens

Trigger: doFilter -> initializeKerberosLogin where serverKeytab is non-blank but new File(serverKeytab).exists() is false on the host being started.

Common situations: Keytab deployed only to some cluster nodes; path typo or hostname-specific filename differing per node; container images built without the keytab mounted; keytab deleted by security rotation.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• Keytab does not exist: %s
• Principals do not exist in the keytab
• Keytab not defined in configuration
• Failed to login as [%s]
• Principal not defined in configuration

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/9ccc4df28d075810. Report an issue: GitHub.