apache/druid · critical · ServletException

Keytab not defined in configuration

Error message

Keytab not defined in configuration

What it means

initializeKerberosLogin checks the server keytab (druid.auth.kerberos.serverKeytab) for null/blank before attempting JAAS login. Missing keytab config means the filter cannot log in its server subject, so doFilter fails with a ServletException at startup.

Source

Thrown at extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java:505

              KerberosUtil.getKrb5LoginModuleName(),
              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
              options
          )
      };
    }
  }

  private void initializeKerberosLogin() throws ServletException
  {
    String keytab;

    try {
      if (serverPrincipal == null || serverPrincipal.trim().length() == 0) {
        throw new ServletException("Principal not defined in configuration");
      }
      keytab = serverKeytab;
      if (keytab == null || keytab.trim().length() == 0) {
        throw new ServletException("Keytab not defined in configuration");
      }
      if (!new File(keytab).exists()) {
        throw new ServletException("Keytab does not exist: " + keytab);
      }

      Set<Principal> principals = new HashSet<>();
      principals.add(new KerberosPrincipal(serverPrincipal));
      Subject subject = new Subject(false, principals, new HashSet<>(), new HashSet<>());

      DruidKerberosConfiguration kerberosConfiguration = new DruidKerberosConfiguration(keytab, serverPrincipal);

      log.info("Login using keytab " + keytab + ", for principal " + serverPrincipal);
      loginContext = new LoginContext("", subject, null, kerberosConfiguration);
      loginContext.login();

      log.info("Initialized, principal %s from keytab %s", serverPrincipal, keytab);
    }
    catch (Exception ex) {

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Set druid.auth.kerberos.serverKeytab to a valid absolute keytab path in the authenticator config
2. Deploy the keytab to all hosts and ensure the druid user can read it
3. Validate the full kerberos property set (principal + keytab) with klist before restarting

Example fix

// before
props.setProperty("druid.auth.kerberos.serverPrincipal", "HTTP/_HOST@EXAMPLE.COM"); // keytab missing
// after
props.setProperty("druid.auth.kerberos.serverKeytab", "/etc/security/keytabs/http.keytab");

String keytab = props.getProperty("druid.auth.kerberos.serverKeytab");
if (keytab == null || keytab.trim().isEmpty()) {
  throw new IllegalStateException("druid.auth.kerberos.serverKeytab must be set");
}

try {
  authenticator.init(config);
} catch (ServletException e) {
  if (e.getMessage().contains("Keytab not defined")) { log.error("serverKeytab missing in kerberos config"); }
  throw e;
}

When it happens

Trigger: doFilter -> initializeKerberosLogin where serverKeytab is null or empty string despite a valid serverPrincipal.

Common situations: serverPrincipal set but serverKeytab forgotten in the authenticator properties; keytab setting removed during config refactor; environment-specific config file not merged.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Principal not defined in configuration
• Keytab not defined in configuration
• Keytab does not exist: %s
• Principals do not exist in the keytab
• Principal not defined in configuration

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/caed38576fbecc43. Report an issue: GitHub.