apache/hadoop · error · RuntimeException

Entry "%s" not found; JAAS config = %s

Error message

Entry "%s" not found; JAAS config = %s

What it means

During SASL setup, RegistrySecurity.validateContext(context) looks up the JAAS login context (default 'Client', or the value of hadoop.registry.jaas.context) in the JVM-wide javax.security.auth.login.Configuration. A null lookup — the context is not defined in the loaded JAAS configuration — throws a RuntimeException with both the context name and the current value of the java.security.auth.login.config property, so you can tell whether a JAAS file was loaded at all.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:724

   * Resolve the context of an entry. This is an effective test of
   * JAAS setup, because it will relay detected problems up
   * @param context context name
   * @return the entry
   * @throws RuntimeException if there is no context entry found
   */
  public static AppConfigurationEntry[] validateContext(String context)  {
    if (context == null) {
      throw new RuntimeException("Null context argument");
    }
    if (context.isEmpty()) {
      throw new RuntimeException("Empty context argument");
    }
    javax.security.auth.login.Configuration configuration =
        javax.security.auth.login.Configuration.getConfiguration();
    AppConfigurationEntry[] entries =
        configuration.getAppConfigurationEntry(context);
    if (entries == null) {
      throw new RuntimeException(
          String.format("Entry \"%s\" not found; " +
                        "JAAS config = %s",
              context,
              describeProperty(Environment.JAAS_CONF_KEY) ));
    }
    return entries;
  }

  /**
   * Apply the security environment to this curator instance. This
   * may include setting up the ZK system properties for SASL
   * @param builder curator builder
   * @throws IOException if jaas configuration can't be generated or found
   */
  public void applySecurityEnvironment(CuratorFrameworkFactory.Builder
      builder) throws IOException {

    if (isSecureRegistry()) {

View on GitHub (pinned to 2add963021)

Solutions

1. Create a JAAS file whose entry name matches hadoop.registry.jaas.context (default 'Client'), e.g. Client { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="..." principal="..."; };
2. Launch the JVM with -Djava.security.auth.login.config=/path/jaas.conf.
3. Alternatively supply the registry principal and keytab (setKerberosPrincipalAndKeytab) so RegistrySecurity builds an in-memory JaasConfiguration.
4. Verify the file is readable and the entry name matches exactly, including case.

Example fix

// before: JVM started without a JAAS config -> RuntimeException: Entry "Client" not found; JAAS config = (unset)
java -jar app.jar

// after
java -Djava.security.auth.login.config=/etc/security/jaas.conf -jar app.jar
# /etc/security/jaas.conf must contain an entry named like hadoop.registry.jaas.context (default "Client"):
Client {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=true
  keyTab="/etc/security/keytabs/registry.keytab"
  principal="registry/_HOST@REALM";
};

// pre-flight check before creating a SASL registry client
String context = conf.get("hadoop.registry.jaas.context", "Client");
try {
  RegistrySecurity.validateContext(context);
} catch (RuntimeException e) {
  throw new IllegalStateException(
      "JAAS entry '" + context + "' missing; check -Djava.security.auth.login.config="
      + System.getProperty("java.security.auth.login.config"), e);
}

try {
  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);
} catch (RuntimeException e) {
  if (e.getMessage().contains("not found; JAAS config")) {
    // add the named entry to the JAAS file (or launch with -Djava.security.auth.login.config) and retry
  }
}

When it happens

Trigger: SASL registry access on a JVM launched without -Djava.security.auth.login.config; a JAAS file that defines no entry matching hadoop.registry.jaas.context (case-sensitive); a context-name mismatch between config and file.

Common situations: Registry-enabled YARN services missing the standard jaas.conf; JVM options dropped when moving a command line into a service definition or container; JAAS file unreadable so the Configuration falls back with no matching entries.

Related errors

• SASL is configured for registry, but neither keytab/principa
• Kerberos required for secure registry access
• Parsing {} :{}
• Server asks us to fall back to SIMPLE auth, but this client
• Service {} is in wrong state: {}

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/633ade7cac226b8c. Report an issue: GitHub.