apache/seatunnel · error · IllegalArgumentException

Please set kerberosKeytabPath

Error message

Please set kerberosKeytabPath

What it means

IllegalArgumentException thrown by HiveMetaStoreProxyUtils.enableKerberos when a kerberosPrincipal is supplied but kerberosKeytabPath is missing/empty. Both principal and keytab are required to perform a kerberos login against the Hive Metastore.

Source

Thrown at seatunnel-connectors-v2/connector-hive/src/main/java/org/apache/seatunnel/connectors/seatunnel/hive/utils/HiveMetaStoreProxyUtils.java:42

@UtilityClass
public class HiveMetaStoreProxyUtils {

    public boolean enableKerberos(ReadonlyConfig config) {
        boolean kerberosPrincipalEmpty =
                config.getOptional(FileBaseSourceOptions.KERBEROS_PRINCIPAL).isPresent();
        boolean kerberosKeytabPathEmpty =
                config.getOptional(FileBaseSourceOptions.KERBEROS_KEYTAB_PATH).isPresent();
        if (kerberosKeytabPathEmpty && kerberosPrincipalEmpty) {
            return true;
        }
        if (!kerberosPrincipalEmpty && !kerberosKeytabPathEmpty) {
            return false;
        }
        if (kerberosPrincipalEmpty) {
            throw new IllegalArgumentException("Please set kerberosPrincipal");
        }
        throw new IllegalArgumentException("Please set kerberosKeytabPath");
    }

    public boolean enableRemoteUser(ReadonlyConfig config) {
        return config.getOptional(FileBaseSourceOptions.REMOTE_USER).isPresent();
    }
}

View on GitHub (pinned to cf67b549a7)

Solutions

1. Add auth.kerberos-keytab-path pointing to an existing keytab file accessible on all nodes
2. Confirm the keytab path resolves (no trailing whitespace/empty env substitution)
3. If kerberos is not intended, remove auth.kerberos-principal too
4. Pre-check both options before enabling kerberos

Example fix

// before
Hive {
  auth.kerberos-principal = "hive/_HOST@EXAMPLE.COM"
}
// after
Hive {
  auth.kerberos-principal = "hive/_HOST@EXAMPLE.COM"
  auth.kerberos-keytab-path = "/etc/security/keytabs/hive.keytab"
}

boolean keytabSet = Optional.ofNullable(config.get(KEYTAB_PATH)).map(p -> !p.trim().isEmpty() && new File(p).exists()).orElse(false);

boolean keytabValid = path != null && !path.trim().isEmpty() && new File(path).isFile();

try { enableKerberos(config); } catch (IllegalArgumentException e) { throw new IllegalArgumentException("kerberosKeytabPath required: " + e.getMessage()); }

When it happens

Trigger: enableKerberos(config) called with kerberosPrincipal set but kerberosKeytabPath empty or absent.

Common situations: Setting the principal but forgetting the keytab path; keytab file path typo resolving through config validation as empty; provisioning the keytab only on some worker nodes and leaving config unset there.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Please set kerberosPrincipal
• Please set kerberosPrincipal
• Please set kerberosKeytabPath
• hadoop.security.authentication must be kerberos
• CREATE_HIVE_TABLE_FAILED

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/b2a23439f652da9d. Report an issue: GitHub.