apache/seatunnel · error · PaimonConnectorException

AUTHENTICATE_KERBEROS_FAILED

AUTHENTICATE_KERBEROS_FAILED

Error message

Failed to login user from keytab : ${kerberosKeytabFilePath} and kerberos principal : ${kerberosPrincipal}

What it means

PaimonSecurityContext.verifyKerberosAuthentication wraps any exception from Paimon's Hadoop `UserGroupInformation.loginUserFromKeytab` (via `install`) into AUTHENTICATE_KERBEROS_FAILED. Paimon silently skips authentication when the keytab path is blank, the principal is blank, or the keytab file does not exist, so this error usually surfaces when login is attempted but fails.

Source

Thrown at seatunnel-connectors-v2/connector-paimon/src/main/java/org/apache/seatunnel/connectors/seatunnel/paimon/security/PaimonSecurityContext.java:131

        options.set(principalKey, kerberosPrincipal);
        options.set(keytabKey, kerberosKeytabFilePath);
        String ticketCacheKey = SecurityConfiguration.KERBEROS_LOGIN_USETICKETCACHE.key();
        boolean ticketCache =
                configuration.getBoolean(
                        ticketCacheKey,
                        SecurityConfiguration.KERBEROS_LOGIN_USETICKETCACHE.defaultValue());
        options.set(ticketCacheKey, String.valueOf(ticketCache));
        try {
            CatalogContext catalogContext = CatalogContext.create(options, configuration);
            if (StringUtils.isNotBlank(krb5Conf)) {
                reloadKrb5conf(krb5Conf);
            }
            // refer: https://paimon.apache.org/docs/master/filesystems/hdfs/#kerberos.
            // If the keytab is blank or principal is blank or keytabFile is not exists, the method
            // of install will not perform kerberos authentication without any exception.
            install(catalogContext);
        } catch (Exception e) {
            throw new PaimonConnectorException(
                    PaimonConnectorErrorCode.AUTHENTICATE_KERBEROS_FAILED,
                    "Failed to login user from keytab : "
                            + kerberosKeytabFilePath
                            + " and kerberos principal : "
                            + kerberosPrincipal,
                    e);
        }
    }

    private static void reloadKrb5conf(String krb5conf) {
        System.setProperty(KRB5_CONF_KEY, krb5conf);
        try {
            Config.refresh();
            KerberosName.resetDefaultRealm();
        } catch (KrbException e) {
            log.warn(
                    "resetting default realm failed, current default realm will still be used.", e);
        }

View on GitHub (pinned to cf67b549a7)

Solutions

Verify the keytab file exists and is readable on every node: `ls -l <keytab>` / `klist -kt <keytab>`
Confirm the principal exactly matches an entry in the keytab (`klist -kt`) including realm
Use the absolute path for kerberos_keytab_path in the config
Test manually with `kinit -kt <keytab> <principal>` to surface KDC/clock issues
Check /etc/krb5.conf and NTP clock sync on the nodes

Example fix

// before
kerberos_keytab_path = "conf/user.keytab" // relative, missing on workers
// after
kerberos_keytab_path = "/etc/security/keytabs/user.keytab"
kerberos_principal = "user/_HOST@REALM.COM"

Defensive patterns

Strategy: validation

Validate before calling

File keytab = new File(kerberosKeytabPath); if (!keytab.isFile() || !keytab.canRead() || kerberosPrincipal == null || kerberosPrincipal.isBlank()) { throw new IllegalStateException("Kerberos keytab/principal missing or unreadable"); }

Try / catch

try { securityContext.verifyKerberosAuthentication(); } catch (PaimonConnectorException e) { if (PaimonConnectorErrorCode.AUTHENTICATE_KERBEROS_FAILED.equals(e.getErrorCode())) { log.error("Kerberos login failed; check keytab/principal/KDC", e); } else { throw e; } }

Prevention

Use absolute keytab paths valid on all nodes
Verify with klist -kt that the principal exists in the keytab
Keep keytabs rotated and krb5.conf/NTP consistent
Pre-flight kinit test before job submission

When it happens

Trigger: kerberos_keytab_path or kerberos_principal configured but wrong: keytab file missing/unreadable, principal not present in the keytab, wrong realm, clock skew, or KDC unreachable during `install(catalogContext)`.

Common situations: Keytab not distributed to all worker nodes; relative keytab path resolved against the wrong working directory; principal name mismatch (host vs _HOST substitution); expired keytab after password change; Kerberos realm typo.

Related errors

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/302da2b57b70f83e. Report an issue: GitHub.