apache/seatunnel · warning

Kerberos authentication is not configured, it will skip kerb

Error message

Kerberos authentication is not configured, it will skip kerberos authentication

What it means

This warning is logged by IcebergCatalogLoader.doKerberosLogin() when the Kerberos configuration is not present, so Kerberos authentication is skipped entirely and the job continues with a non-secure Hadoop configuration. It is informational for unsecured clusters, but a red flag if your HDFS/Hive catalog actually requires Kerberos — subsequent file access will then fail with permission or authentication errors.

Source

Thrown at seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java:150

    private Configuration doKerberosLogin(Configuration configuration) {
        String kerberosKrb5ConfPath = config.getKerberosKrb5ConfPath();
        String kerberosKeytabPath = config.getKerberosKeytabPath();
        String kerberosPrincipal = config.getKerberosPrincipal();

        if (StringUtils.isNotEmpty(kerberosPrincipal)
                && StringUtils.isNotEmpty(kerberosKrb5ConfPath)
                && StringUtils.isNotEmpty(kerberosKeytabPath)) {
            try {
                System.setProperty("java.security.krb5.conf", kerberosKrb5ConfPath);
                System.setProperty("krb.principal", kerberosPrincipal);
                doKerberosAuthentication(configuration, kerberosPrincipal, kerberosKeytabPath);
            } catch (Exception e) {
                throw new IcebergConnectorException(
                        CommonErrorCode.KERBEROS_AUTHORIZED_FAILED,
                        String.format("Kerberos authentication failed: %s", e.getMessage()));
            }
        } else {
            log.warn(
                    "Kerberos authentication is not configured, it will skip kerberos authentication");
        }

        return configuration;
    }

    public static void doKerberosAuthentication(
            Configuration configuration, String principal, String keytabPath) {
        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {
            log.warn(
                    "Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication",
                    principal,
                    keytabPath);
        } else {
            configuration.set("hadoop.security.authentication", "kerberos");
            UserGroupInformation.setConfiguration(configuration);
            try {
                log.info(

View on GitHub (pinned to cf67b549a7)

Solutions

1. If your cluster is secured, configure the Kerberos options (principal, keytab path, krb5 conf) on the Iceberg sink/catalog and rerun.
2. If the cluster is unsecured, ignore this warning — it confirms Kerberos was intentionally skipped.
3. If auth was expected via another mechanism (e.g. keytab auto-detected), verify the option names and values match the connector's documented keys.

Example fix

// before
sink {
  Iceberg {
    catalog_name = "hive"
  }
}
// after
sink {
  Iceberg {
    catalog_name = "hive"
    kerberos_principal = "user@EXAMPLE.COM"
    kerberos_keytab_path = "/etc/security/keytabs/user.keytab"
    krb5_path = "/etc/krb5.conf"
  }
}

if (isSecuredCluster && (principal == null || keytabPath == null || krb5Path == null)) {
    throw new IllegalArgumentException("Kerberos options required for secured cluster: principal, keytabPath, krb5Path");
}

When it happens

Trigger: doKerberosLogin() is invoked during loadCatalog(); the check that gates kerberos login (krb5/principal/keytab options enabled) evaluates false, taking the else branch that logs this warning and returns the configuration unchanged.

Common situations: Forgetting to set kerberos options (principal/keytab/krb5 path) on a secured cluster; running locally where the secure options were omitted; clusters without Kerberos where the warning is expected and harmless.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• CommonErrorCode.KERBEROS_AUTHORIZED_FAILED
• check connectivity failed,
• KERBEROS_AUTHENTICATION_FAILED
• Kerberos re-login for HiveMetaStore failed: {}
• Principal [{}] or keytabPath [{}] is empty, it will skip ker

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/9dca538340eb229b. Report an issue: GitHub.