apache/hadoop · error · LoginException

Failed to find user in name " + subject

Error message

Failed to find user in name " + subject

What it means

HadoopLoginModule.commit() attaches a User principal to the JAAS subject by walking subject.getPrincipals() and wrapping the first one (Kerberos or simple). If the subject contains no principals at all when commit runs, it throws this LoginException (the message stringifies the subject), aborting the login.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java:234

      if (user != null) {
        LOG.debug("Using user: \"{}\" with name: {}", user, user.getName());

        User userEntry = null;
        try {
          // LoginContext will be attached later unless it's an external
          // subject.
          AuthenticationMethod authMethod = (user instanceof KerberosPrincipal)
            ? AuthenticationMethod.KERBEROS : AuthenticationMethod.SIMPLE;
          userEntry = new User(user.getName(), authMethod, null);
        } catch (Exception e) {
          throw (LoginException)(new LoginException(e.toString()).initCause(e));
        }
        LOG.debug("User entry: \"{}\"", userEntry);

        subject.getPrincipals().add(userEntry);
        return true;
      }
      throw new LoginException("Failed to find user in name " + subject);
    }

    @Override
    public void initialize(Subject subject, CallbackHandler callbackHandler,
                           Map<String, ?> sharedState, Map<String, ?> options) {
      this.subject = subject;
    }

    @Override
    public boolean login() throws LoginException {
      LOG.debug("Hadoop login");
      return true;
    }

    @Override
    public boolean logout() throws LoginException {
      LOG.debug("Hadoop logout");
      return true;

View on GitHub (pinned to 2add963021)

Solutions

1. Run `klist`; if empty, `kinit` before starting the client/job
2. Prefer UserGroupInformation.loginUserFromKeytab(principal, keytab) or loginUserFromTicketCache over hand-built JAAS subjects
3. Verify no custom javax.security.auth.login.Configuration is stripping Hadoop's login modules
4. For externally authenticated subjects, add at least one Principal (a KerberosPrincipal) before calling getUGIFromSubject

if (subject.getPrincipals().isEmpty()) {
  throw new IllegalStateException(
      "cannot login: subject has no principals");
}

try {
  UserGroupInformation.loginUserFromKeytab(principal, keytab);
} catch (LoginException | KerberosAuthException e) {
  // LoginException text 'Failed to find user' means commit() saw an empty subject
  LOG.error("Hadoop login failed for {}", principal, e);
  throw e;
}

When it happens

Trigger: Any login path that installs HadoopLoginModule (loginUserFromKeytab, loginUserFromTicketCache, doSubjectLogin/getUGIFromSubject) reaching commit() with an empty subject - a Kerberos module failed before adding its principal, a custom JAAS configuration replaced Hadoop's, or an externally built Subject was handed over with no Principal.

Common situations: No TGT (missing kinit) so Krb5LoginModule added no principal; krb5.conf misconfigured or KDC unreachable; a hand-written JAAS config file overriding the hadoop-client entries; code constructing bare Subjects for SPNEGO.

Related errors

• Illegal principal name " + name + ": " + ioe.toString()
• Problem with Kerberos auth_to_local name configuration
• Invalid attribute value for hadoop.kerberos.min.seconds.befo
• Subject must not be null
• Provided Subject must contain a KerberosPrincipal

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/d5eb654e98e011e2. Report an issue: GitHub.