What causes "Kerberos required for secure registry access" in apache/hadoop?

Set hadoop.security.authentication=kerberos and call UserGroupInformation.setConfiguration(conf) before creating the registry client.

apache/hadoop · error · IOException

Kerberos required for secure registry access

Error message

Kerberos required for secure registry access

What it means

With client.auth=kerberos (SASL policy), RegistrySecurity.initSecurity requires that Hadoop security is already active in this JVM: UserGroupInformation.isSecurityEnabled() must be true, meaning UGI was initialized with a Configuration where hadoop.security.authentication=kerberos. If not, it throws IOException('Kerberos required for secure registry access') because SASL authentication has no credentials to draw on.

Source

Thrown at hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java:273

                              DEFAULT_REGISTRY_USER_ACCOUNTS);
      List<ACL> userACLs = buildACLs(user, kerberosRealm, ZooDefs.Perms.ALL);

      // add self if the current user can be determined
      ACL self;
      if (UserGroupInformation.isSecurityEnabled()) {
        self = createSaslACLFromCurrentUser(ZooDefs.Perms.ALL);
        if (self != null) {
          userACLs.add(self);
        }
      }
      LOG.info("Registry User ACLs " + System.lineSeparator()+ userACLs);

      // here check for UGI having secure on or digest + ID
      switch (access) {
        case sasl:
          // secure + SASL => has to be authenticated
          if (!UserGroupInformation.isSecurityEnabled()) {
            throw new IOException("Kerberos required for secure registry access");
          }
          UserGroupInformation currentUser =
              UserGroupInformation.getCurrentUser();
          jaasClientEntry = getOrFail(KEY_REGISTRY_CLIENT_JAAS_CONTEXT,
              DEFAULT_REGISTRY_CLIENT_JAAS_CONTEXT);
          jaasClientIdentity = currentUser.getShortUserName();
          if (LOG.isDebugEnabled()) {
            LOG.debug("Auth is SASL user=\"{}\" JAAS context=\"{}\"",
                jaasClientIdentity, jaasClientEntry);
          }
          break;

        case digest:
          String id = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_ID, "");
          String pass = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_PASSWORD, "");
          if (userACLs.isEmpty()) {
            //
            throw new ServiceStateException(E_NO_USER_DETERMINED_FOR_ACLS);

View on GitHub (pinned to 2add963021)

Solutions

Set hadoop.security.authentication=kerberos and call UserGroupInformation.setConfiguration(conf) before creating the registry client.
Log in via kinit or UserGroupInformation.loginUserFromKeytab so a Kerberos UGI exists.
If the deployment is genuinely insecure, switch the registry client to anonymous/simple auth instead of kerberos.

Example fix

// before
conf.set("hadoop.registry.client.auth", "kerberos"); // but hadoop.security.authentication=simple -> IOException
RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);

// after: initialize Hadoop security first
conf.set("hadoop.security.authentication", "kerberos");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab(principal, keytabPath);
RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);

Defensive patterns

Strategy: validation

Validate before calling

if (conf.get("hadoop.registry.client.auth").equals("kerberos")
    && !UserGroupInformation.isSecurityEnabled()) {
  throw new IllegalStateException(
      "Registry SASL requires Hadoop security: set hadoop.security.authentication=kerberos "
      + "and UserGroupInformation.setConfiguration(conf) before creating the client");
}

Try / catch

try {
  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);
} catch (IOException e) {
  if (e.getMessage().contains("Kerberos required")) {
    // initialize Hadoop security (setConfiguration + keytab login) or fall back to anonymous auth
  }
}

Prevention

Always call UserGroupInformation.setConfiguration(conf) with the final secure Configuration before creating secure registry clients.
Verify hadoop.security.authentication=kerberos in the effective config, not just the registry keys.
In insecure dev clusters, configure anonymous/simple registry auth rather than reusing kerberos settings.

When it happens

Trigger: Creating a kerberos registry client while UGI still reflects hadoop.security.authentication=simple (setConfiguration never called with the secure conf, or called after client creation); unit tests without Kerberos infrastructure; secure registry config applied in an insecure cluster.

Common situations: core-site.xml still on authentication=simple while registry client config says kerberos; config ordering bugs where UserGroupInformation is initialized before the secure Configuration is loaded; dev environments cloned from secure clusters.

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/56d5ab6c237f40d1. Report an issue: GitHub.