apache/hadoop · error · AccessControlException

Kerberos principal name does NOT have the expected hostname

Error message

Kerberos principal name does NOT have the expected hostname part: 

What it means

When SaslRpcServer.create handles KERBEROS, the server principal from UserGroupInformation.getCurrentUser() is split on / and @ (the constructor maps parts[1] to serverId). If the principal has no host component, such as hdfs@REALM instead of hdfs/_HOST@REALM, serverId is empty and the server throws AccessControlException because no service principal can be formed for the SASL GSSAPI mechanism.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcServer.java:141

  }
  
  @InterfaceAudience.Private
  @InterfaceStability.Unstable
  public SaslServer create(final Connection connection,
                           final Map<String,?> saslProperties,
                           SecretManager<TokenIdentifier> secretManager
      ) throws IOException, InterruptedException {
    UserGroupInformation ugi = null;
    final CallbackHandler callback;
    switch (authMethod) {
      case TOKEN: {
        callback = new SaslDigestCallbackHandler(secretManager, connection);
        break;
      }
      case KERBEROS: {
        ugi = UserGroupInformation.getCurrentUser();
        if (serverId.isEmpty()) {
          throw new AccessControlException(
              "Kerberos principal name does NOT have the expected "
                  + "hostname part: " + ugi.getUserName());
        }
        callback = new SaslGssCallbackHandler();
        break;
      }
      default:
        // we should never be able to get here
        throw new AccessControlException(
            "Server does not support SASL " + authMethod);
    }
    
    final SaslServer saslServer;
    if (ugi != null) {
      saslServer = ugi.doAs(
        new PrivilegedExceptionAction<SaslServer>() {
          @Override
          public SaslServer run() throws SaslException  {

View on GitHub (pinned to 2add963021)

Solutions

1. Set the daemon principal to service/_HOST@REALM (e.g. nn/_HOST@EXAMPLE.COM) so the host part is present after substitution
2. Verify the keytab with klist -kt <keytab> and confirm it contains a service principal with a host component
3. Check hadoop.security.auth_to_local rules are not stripping the host part unexpectedly
4. In custom code, log UserGroupInformation.getCurrentUser() immediately before SaslRpcServer creation and confirm it has three components (service/host@REALM)

Example fix

<!-- before -->
<property><name>dfs.namenode.kerberos.principal</name><value>nn@EXAMPLE.COM</value></property>

<!-- after -->
<property><name>dfs.namenode.kerberos.principal</name><value>nn/_HOST@EXAMPLE.COM</value></property>

String principal = conf.get("dfs.namenode.kerberos.principal", "");
String[] parts = principal.split("[/@]", 3);
if (UserGroupInformation.isSecurityEnabled()
    && (parts.length < 3 || parts[1].isEmpty())) {
  throw new IllegalStateException(
      "Kerberos principal must have a host component (service/_HOST@REALM): " + principal);
}

static boolean principalHasHostPart(String principal) {
  String[] p = principal == null ? new String[0] : principal.split("[/@]", 3);
  return p.length == 3 && !p[1].isEmpty();
}

When it happens

Trigger: Starting a Kerberos SASL RPC server while the current UGI was logged in from a keytab whose principal is a bare user principal (no service/host part); test or embedded code that calls UserGroupInformation.loginUserFromKeytab('user@REALM', keytab) and then builds a SaslRpcServer with authMethod KERBEROS.

Common situations: dfs.namenode.kerberos.principal / dfs.datanode.kerberos.principal set to a bare user principal; principals renamed without the /_HOST part during a Kerberos migration; auth_to_local rules rewriting the principal before the server reads it.

Related errors

• Malformed Kerberos name: ${name}
• Server asks us to fall back to SIMPLE auth, but this client
• Client did not send a token
• Unrecognized SASL client callback
• Unable to find SASL server implementation for

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/5b1a56fa5e0efaa8. Report an issue: GitHub.