apache/pulsar · error · IllegalArgumentException

Can't get Kerberos configuration

Error message

Can't get Kerberos configuration

What it means

KerberosName's static initializer resolves the default Kerberos realm via getDefaultRealm2() (parsing krb5.conf / sun.security.krb5.Config). If that fails and the zookeeper.requireKerberosConfig system property is set to true, it throws IllegalArgumentException('Can't get Kerberos configuration'); otherwise it degrades to an empty default realm.

Source

Thrown at pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java:102

        if (System.getProperty("java.vendor").contains("IBM")) {
            classRef = Class.forName("com.ibm.security.krb5.internal.Config");
        } else {
            classRef = Class.forName("sun.security.krb5.Config");
        }
        getInstanceMethod = classRef.getMethod("getInstance");
        kerbConf = getInstanceMethod.invoke(classRef);
        getDefaultRealmMethod = classRef.getDeclaredMethod("getDefaultRealm"
        );
        return (String) getDefaultRealmMethod.invoke(kerbConf, new Object[0]);
    }

    static {
        try {
            defaultRealm = getDefaultRealm2();
        } catch (Exception ke) {
            if ((System.getProperty("zookeeper.requireKerberosConfig") != null)
                && (System.getProperty("zookeeper.requireKerberosConfig").equals("true"))) {
                throw new IllegalArgumentException("Can't get Kerberos configuration", ke);
            } else {
                defaultRealm = "";
            }
        }
        try {
            // setConfiguration() will work even if the above try() fails due
            // to a missing Kerberos configuration (unless zookeeper.requireKerberosConfig
            // is set to true, which would not allow execution to reach here due to the
            // throwing of an IllegalArgumentException above).
            setConfiguration();
        } catch (IOException e) {
            throw new IllegalArgumentException("Could not configure Kerberos principal name mapping.");
        }
    }

    /**
     * Create a name from the full Kerberos principal name.
     * @param name

View on GitHub (pinned to 820761864e)

Solutions

1. Install/restore a valid /etc/krb5.conf with [libdefaults] default_realm set
2. Set KRB5_CONFIG to the actual location of the Kerberos config file
3. Fix syntax errors in krb5.conf and verify with 'kvno' or kinit
4. If Kerberos is optional, unset zookeeper.requireKerberosConfig so startup degrades gracefully

Example fix

// before (krb5.conf)
[libdefaults]
  missing_realm_directive
// after
[libdefaults]
  default_realm = EXAMPLE.COM
[realms]
  EXAMPLE.COM = { kdc = kdc.example.com }

// Check Kerberos config presence before touching KerberosName
String krb5 = System.getenv().getOrDefault("KRB5_CONFIG", "/etc/krb5.conf");
java.io.File f = new java.io.File(krb5);
if (!f.canRead() || !new String(java.nio.file.Files.readAllBytes(f.toPath())).contains("default_realm")) {
    throw new IllegalStateException("Invalid Kerberos config at " + krb5);
}

static boolean kerberosConfigPresent() {
    String p = System.getenv("KRB5_CONFIG");
    return p == null ? new java.io.File("/etc/krb5.conf").canRead()
                     : new java.io.File(p).canRead();
}

try {
    Class.forName("org.apache.pulsar.common.sasl.KerberosName");
} catch (Throwable t) {
    Throwable cause = t.getCause();
    log.error("Kerberos config unavailable: {}", cause == null ? t : cause);
    if (Boolean.getBoolean("zookeeper.requireKerberosConfig")) throw t;
    log.warn("Continuing without default realm");
}

When it happens

Trigger: Class-loading KerberosName when Kerberos configuration cannot be read (missing /etc/krb5.conf, malformed krb5.conf, missing default_realm) while -Dzookeeper.requireKerberosConfig=true.

Common situations: Containers without krb5.conf; Kerberos config in a non-default path without KRB5_CONFIG set; typo in krb5.conf making it unparseable; deliberately strict deployments enabling requireKerberosConfig.

Related errors

• No offloader found for driver '${driverName}'. Please make s
• Could not open configuration file
• Malformed configuration file
• Need to specify a configuration file for broker
• Max message size need smaller than jvm directMemory

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/c6071c91f822697e. Report an issue: GitHub.