apache/seatunnel · error · IllegalArgumentException

hadoop.security.authentication must be kerberos

Error message

hadoop.security.authentication must be kerberos

What it means

HadoopLoginFactory.loginWithKerberos only performs Kerberos login when the Hadoop configuration has hadoop.security.authentication set to 'kerberos'. Before logging in it asserts this property; if it is missing or set to anything else (e.g. 'simple', the default), it throws IllegalArgumentException.

Source

Thrown at seatunnel-connectors-v2/connector-file/connector-file-base/src/main/java/org/apache/seatunnel/connectors/seatunnel/file/hadoop/HadoopLoginFactory.java:39

import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.security.UserGroupInformation;

import java.io.IOException;
import java.security.PrivilegedExceptionAction;

public class HadoopLoginFactory {

    /** Login with kerberos, and do the given action after login successfully. */
    public static <T> T loginWithKerberos(
            Configuration configuration,
            String krb5FilePath,
            String kerberosPrincipal,
            String kerberosKeytabPath,
            LoginFunction<T> action)
            throws IOException, InterruptedException {
        if (!configuration.get("hadoop.security.authentication").equals("kerberos")) {
            throw new IllegalArgumentException("hadoop.security.authentication must be kerberos");
        }
        // Use global lock to avoid multiple threads to execute setConfiguration at the same time
        synchronized (UserGroupInformation.class) {
            if (StringUtils.isNotEmpty(krb5FilePath)) {
                System.setProperty("java.security.krb5.conf", krb5FilePath);
            }
            // init configuration
            UserGroupInformation.setConfiguration(configuration);
            UserGroupInformation userGroupInformation =
                    UserGroupInformation.loginUserFromKeytabAndReturnUGI(
                            kerberosPrincipal, kerberosKeytabPath);
            return userGroupInformation.doAs(
                    (PrivilegedExceptionAction<T>)
                            () -> action.run(configuration, userGroupInformation));
        }
    }

    /** Login with remote user, and do the given action after login successfully. */

View on GitHub (pinned to cf67b549a7)

Solutions

  1. Copy the cluster's core-site.xml (with hadoop.security.authentication = kerberos) into the SeaTunnel classpath/config directory
  2. Set the property programmatically or in the connector config as supported (e.g. via hadoop security config / 'hadoop.security.authentication' = 'kerberos')
  3. If the cluster uses simple auth, remove the Kerberos options instead of enabling Kerberos login

Example fix

// before (config lacks hadoop auth)
HdfsFile {
  kerberos_principal = "hdfs@EXAMPLE.COM"
  kerberos_keytab_path = "/etc/security/keytab/hdfs.keytab"
}
// after
HdfsFile {
  kerberos_principal = "hdfs@EXAMPLE.COM"
  kerberos_keytab_path = "/etc/security/keytab/hdfs.keytab"
  hadoop_user_name = "hdfs"
}
// plus ensure core-site.xml on classpath contains:
// <property><name>hadoop.security.authentication</name><value>kerberos</value></property>
Defensive patterns

Strategy: validation

Validate before calling

if (config.get("kerberos_principal") != null && !"kerberos".equals(hadoopConf.get("hadoop.security.authentication"))) {
    throw new IllegalArgumentException("Kerberos options require hadoop.security.authentication=kerberos in core-site.xml");
}

Prevention

When it happens

Trigger: Calling the file connector with Kerberos options (principal/keytab) while the underlying Hadoop configuration (core-site.xml or programmatically built Configuration) lacks hadoop.security.authentication = kerberos.

Common situations: Not placing the cluster's core-site.xml (and hdfs-site.xml) on the classpath or not referencing it via krb configs; a minimal Configuration object built only from connector options; cluster downgraded/reconfigured from Kerberos to simple auth.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/b19d4a850bd88fe0. Report an issue: GitHub.