apache/seatunnel · error · HudiConnectorException

KERBEROS_AUTHORIZED_FAILED

KERBEROS_AUTHORIZED_FAILED

Error message

Kerberos Authorized Fail!

What it means

HudiUtil.initKerberosAuthentication wraps UserGroupInformation.loginUserFromKeytab failures in a HudiConnectorException with KERBEROS_AUTHORIZED_FAILED. The login itself (reading the keytab, contacting the KDC, building the UGI configuration) threw an IOException, so Kerberos authentication could not be established.

Source

Thrown at seatunnel-connectors-v2/connector-hudi/src/main/java/org/apache/seatunnel/connectors/seatunnel/hudi/util/HudiUtil.java:134

        }
        return new SeaTunnelRowType(fields, types);
    }

    public static JobConf toJobConf(Configuration conf) {
        if (conf instanceof JobConf) {
            return (JobConf) conf;
        }
        return new JobConf(conf);
    }

    public static void initKerberosAuthentication(
            Configuration conf, String principal, String principalFile)
            throws HudiConnectorException {
        try {
            UserGroupInformation.setConfiguration(conf);
            UserGroupInformation.loginUserFromKeytab(principal, principalFile);
        } catch (IOException e) {
            throw new HudiConnectorException(
                    CommonErrorCodeDeprecated.KERBEROS_AUTHORIZED_FAILED,
                    "Kerberos Authorized Fail!",
                    e);
        }
    }

    public static HoodieJavaWriteClient<HoodieAvroPayload> createHoodieJavaWriteClient(
            HudiSinkConfig hudiSinkConfig, SeaTunnelRowType seaTunnelRowType, String tableName) {
        List<HudiTableConfig> tableList = hudiSinkConfig.getTableList();
        Optional<HudiTableConfig> hudiTableConfig =
                tableList.stream()
                        .filter(table -> table.getTableName().equals(tableName))
                        .findFirst();
        if (!hudiTableConfig.isPresent()) {
            throw new HudiConnectorException(
                    TABLE_CONFIG_NOT_FOUND,
                    "The corresponding table "
                            + tableName

View on GitHub (pinned to cf67b549a7)

Solutions

1. Verify the keytab file exists and is readable by the SeaTunnel worker user: klist -kt <principalFile> and test with kinit -kt <principalFile> <principal>.
2. Confirm the principal exactly matches an entry in the keytab (klist -k output), including realm casing.
3. Ensure the Hadoop conf directory (core-site.xml, hdfs-site.xml) listed in hudi_sink conf_files_path is accessible and contains kerberos settings.
4. Check KDC reachability and clock sync (ntp/chronyd); enable Hadoop debug via HADOOP_JAAS_DEBUG=true or -Dsun.security.krb5.debug=true to see the failure cause.
5. Increase the SeaTunnel JVM memory for large UGI configs is not needed — instead confirm io retries; then re-run the job.

Example fix

// before
hudi {
  kerberos_principal = "user@EXAMPLE.COM"
  kerberos_keytab_path = "/etc/security/keytab/user.keytab"
}
// after (verify with kinit first; fix principal/keytab mismatch)
# kinit -kt /etc/security/keytab/user.keytab user@EXAMPLE.COM
hudi {
  kerberos_principal = "user@EXAMPLE.COM"
  kerberos_keytab_path = "/etc/security/keytab/user.keytab"  # must exist on every node
}

// shell pre-check before submitting the job
klist -kt /etc/security/keytab/user.keytab && kinit -kt /etc/security/keytab/user.keytab user@EXAMPLE.COM
// java: check readability
File keytab = new File(principalFile);
if (!keytab.canRead()) throw new IllegalStateException("keytab unreadable: " + principalFile);

try {
    initKerberosAuthentication(conf, principal, keytabPath);
} catch (HudiConnectorException e) {
    LOG.error("Kerberos login failed for principal {} with keytab {}", principal, keytabPath, e);
    throw e; // auth failure should fail fast
}

When it happens

Trigger: initKerberosAuthentication is called with a Hadoop Configuration, a principal, and a keytab principalFile; UserGroupInformation.setConfiguration(conf) or loginUserFromKeytab(principal, principalFile) throws IOException.

Common situations: Keytab file path wrong or file unreadable by the SeaTunnel process; principal name does not match an entry in the keytab (kinit -kt fails); KDC unreachable / DNS resolution of realm hosts failing; clock skew between client and KDC; missing hdfs-site.xml/core-site.xml in confFilesPath so the UGI config lacks auth settings; encrypted-keytab-not-supported JCE issues.

Related errors

• CommonErrorCode.KERBEROS_AUTHORIZED_FAILED
• check connectivity failed,
• Failed to login user from keytab : ${keytabPath} and kerbero
• Kerberos re-login from keytab failed: {}
• Please set kerberosPrincipal

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/0b7ca0ac7af6afb3. Report an issue: GitHub.