apache/seatunnel · error · HudiConnectorException

KERBEROS_AUTHORIZED_FAILED

KERBEROS_AUTHORIZED_FAILED

Error message

Kerberos Authorized Fail!

What it means

HudiUtil.initKerberosAuthentication wraps UserGroupInformation.loginUserFromKeytab failures in a HudiConnectorException with KERBEROS_AUTHORIZED_FAILED. The login itself (reading the keytab, contacting the KDC, building the UGI configuration) threw an IOException, so Kerberos authentication could not be established.

Solutions

1. Verify the keytab file exists and is readable by the SeaTunnel worker user: klist -kt <principalFile> and test with kinit -kt <principalFile> <principal>.
2. Confirm the principal exactly matches an entry in the keytab (klist -k output), including realm casing.
3. Ensure the Hadoop conf directory (core-site.xml, hdfs-site.xml) listed in hudi_sink conf_files_path is accessible and contains kerberos settings.
4. Check KDC reachability and clock sync (ntp/chronyd); enable Hadoop debug via HADOOP_JAAS_DEBUG=true or -Dsun.security.krb5.debug=true to see the failure cause.
5. Increase the SeaTunnel JVM memory for large UGI configs is not needed — instead confirm io retries; then re-run the job.

Example fix

// before
hudi {
  kerberos_principal = "user@EXAMPLE.COM"
  kerberos_keytab_path = "/etc/security/keytab/user.keytab"
}
// after (verify with kinit first; fix principal/keytab mismatch)
# kinit -kt /etc/security/keytab/user.keytab user@EXAMPLE.COM
hudi {
  kerberos_principal = "user@EXAMPLE.COM"
  kerberos_keytab_path = "/etc/security/keytab/user.keytab"  # must exist on every node
}

// shell pre-check before submitting the job
klist -kt /etc/security/keytab/user.keytab && kinit -kt /etc/security/keytab/user.keytab user@EXAMPLE.COM
// java: check readability
File keytab = new File(principalFile);
if (!keytab.canRead()) throw new IllegalStateException("keytab unreadable: " + principalFile);

try {
    initKerberosAuthentication(conf, principal, keytabPath);
} catch (HudiConnectorException e) {
    LOG.error("Kerberos login failed for principal {} with keytab {}", principal, keytabPath, e);
    throw e; // auth failure should fail fast
}

When it happens

Trigger: initKerberosAuthentication is called with a Hadoop Configuration, a principal, and a keytab principalFile; UserGroupInformation.setConfiguration(conf) or loginUserFromKeytab(principal, principalFile) throws IOException.

Common situations: Keytab file path wrong or file unreadable by the SeaTunnel process; principal name does not match an entry in the keytab (kinit -kt fails); KDC unreachable / DNS resolution of realm hosts failing; clock skew between client and KDC; missing hdfs-site.xml/core-site.xml in confFilesPath so the UGI config lacks auth settings; encrypted-keytab-not-supported JCE issues.

Related errors

• check connectivity failed,
• CommonErrorCode.KERBEROS_AUTHORIZED_FAILED
• Failed to login user from keytab
• Kerberos re-login from keytab failed
• AUTHENTICATE_KERBEROS_FAILED

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/0b7ca0ac7af6afb3. Report an issue: GitHub.

Appendix: source

Thrown at seatunnel-connectors-v2/connector-hudi/src/main/java/org/apache/seatunnel/connectors/seatunnel/hudi/util/HudiUtil.java:134

        }
        return new SeaTunnelRowType(fields, types);
    }

    public static JobConf toJobConf(Configuration conf) {
        if (conf instanceof JobConf) {
            return (JobConf) conf;
        }
        return new JobConf(conf);
    }

    public static void initKerberosAuthentication(
            Configuration conf, String principal, String principalFile)
            throws HudiConnectorException {
        try {
            UserGroupInformation.setConfiguration(conf);
            UserGroupInformation.loginUserFromKeytab(principal, principalFile);
        } catch (IOException e) {
            throw new HudiConnectorException(
                    CommonErrorCodeDeprecated.KERBEROS_AUTHORIZED_FAILED,
                    "Kerberos Authorized Fail!",
                    e);
        }
    }

    public static HoodieJavaWriteClient<HoodieAvroPayload> createHoodieJavaWriteClient(
            HudiSinkConfig hudiSinkConfig, SeaTunnelRowType seaTunnelRowType, String tableName) {
        List<HudiTableConfig> tableList = hudiSinkConfig.getTableList();
        Optional<HudiTableConfig> hudiTableConfig =
                tableList.stream()
                        .filter(table -> table.getTableName().equals(tableName))
                        .findFirst();
        if (!hudiTableConfig.isPresent()) {
            throw new HudiConnectorException(
                    TABLE_CONFIG_NOT_FOUND,
                    "The corresponding table "
                            + tableName

View on GitHub (pinned to cf67b549a7)