apache/hadoop · error · SaslException

Bad Kerberos server principal configuration

Error message

Bad Kerberos server principal configuration

What it means

Error "Bad Kerberos server principal configuration" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:247

              " or user doesn't have one");
          return null;
        }
        saslCallback = new SaslClientCallbackHandler(token);
        break;
      }
      case KERBEROS: {
        if (ugi.getRealAuthenticationMethod().getAuthMethod() !=
            AuthMethod.KERBEROS) {
          LOG.debug("client isn't using kerberos");
          return null;
        }
        final String serverPrincipal;
        try {
          serverPrincipal = getServerPrincipal(authType);
        } catch (IllegalArgumentException ex) {
          // YARN-11210: getServerPrincipal can throw IllegalArgumentException if Kerberos
          // configuration is bad, this is surfaced as a non-retryable SaslException
          throw new SaslException("Bad Kerberos server principal configuration", ex);
        }
        if (serverPrincipal == null) {
          LOG.debug("protocol doesn't use kerberos");
          return null;
        }
        if (LOG.isDebugEnabled()) {
          LOG.debug("RPC Server's Kerberos principal name for protocol="
              + protocol.getCanonicalName() + " is " + serverPrincipal);
        }
        break;
      }
      default:
        throw new IOException("Unknown authentication method " + method);
    }

    String mechanism = method.getMechanismName();
    if (LOG.isDebugEnabled()) {
      LOG.debug("Creating SASL " + mechanism + "(" + method + ") "

View on GitHub (pinned to 2add963021)

Solutions

1. Correct the server Kerberos principal configuration for the protocol; the principal must include the server hostname (or _HOST resolvable) and a valid realm.
2. Verify the keytab referenced contains the configured principal.
3. Check DNS/reverse-DNS so the hostname used in the principal resolves correctly.

When it happens

Trigger: Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:247 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/94160e11f2c30cbc. Report an issue: GitHub.