apache/seatunnel · warning

Principal [{}] or keytabPath [{}] is empty, it will skip ker

Error message

Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication

What it means

HiveJdbcUtils.doKerberosAuthentication sets the krb5 conf system property, then checks whether principal or keytabPath is blank. If either is empty, Kerberos login is skipped with this warning; otherwise Hadoop UGI is configured for kerberos and loginUserFromKeytab is performed.

Source

Thrown at seatunnel-connectors-v2/connector-jdbc/src/main/java/org/apache/seatunnel/connectors/seatunnel/jdbc/utils/HiveJdbcUtils.java:45

import lombok.extern.slf4j.Slf4j;

import java.io.IOException;

import static org.apache.seatunnel.connectors.seatunnel.jdbc.exception.JdbcConnectorErrorCode.KERBEROS_AUTHENTICATION_FAILED;

@Slf4j
public class HiveJdbcUtils {

    public static synchronized void doKerberosAuthentication(JdbcConnectionConfig jdbcConfig) {
        String principal = jdbcConfig.getKerberosPrincipal();
        String keytabPath = jdbcConfig.getKerberosKeytabPath();
        String krb5Path = jdbcConfig.getKrb5Path();
        System.setProperty("java.security.krb5.conf", krb5Path);
        Configuration configuration = new Configuration();

        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {
            log.warn(
                    "Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication",
                    principal,
                    keytabPath);
        } else {
            configuration.set("hadoop.security.authentication", "kerberos");
            UserGroupInformation.setConfiguration(configuration);
            try {
                log.info(
                        "Start Kerberos authentication using principal {} and keytab {}",
                        principal,
                        keytabPath);
                UserGroupInformation.loginUserFromKeytab(principal, keytabPath);
                log.info("Kerberos authentication successful");
            } catch (IOException e) {
                String errorMsg =
                        String.format(
                                "Kerberos authentication failed using this "
                                        + "principal [%s] and keytab path [%s]",

View on GitHub (pinned to cf67b549a7)

Solutions

1. Set both kerberos_principal and kerberos_keytab_path in the JDBC connection config to enable Kerberos auth.
2. Verify the keytab file exists and is readable by the SeaTunnel process.
3. If Kerberos is not required, this warning is safe to ignore (connection proceeds without Kerberos).
4. Check for typos/extra whitespace in the config values (isBlank treats whitespace-only as empty).

Example fix

// before
url = "jdbc:hive2://host:10000/db;principal=hive/_HOST@REALM"
# kerberos_keytab_path not set
// after
url = "jdbc:hive2://host:10000/db"
auth.type = "kerberos"
kerberos_principal = "user@REALM"
kerberos_keytab_path = "/etc/security/keytabs/user.keytab"
krb5_path = "/etc/krb5.conf"

if (isBlank(principal) || isBlank(keytabPath)) {
    throw new IllegalArgumentException("kerberos_principal and kerberos_keytab_path must both be set for Kerberos auth");
}

When it happens

Trigger: doKerberosAuthentication is called with a JdbcConnectionConfig where kerberos_principal or kerberos_keytab_path is null/empty/whitespace while some kerberos-related settings (e.g. krb5 path) are present.

Common situations: Users enable kerberos partially (set krb5.conf but forget principal or keytab path); auth.type=kerberos misconfig; copied config template without filling in credential fields.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• KERBEROS_AUTHENTICATION_FAILED
• UNSUPPORTED_AUTH_TYPE
• Unsupported auth type:
• KERBEROS_AUTHORIZED_FAILED
• CommonErrorCode.KERBEROS_AUTHORIZED_FAILED

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/7073fb245945bcf2. Report an issue: GitHub.