Principal [{}] or keytabPath [{}] is empty, it will skip ker

Error message

Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication

What it means

This warning is raised by IcebergCatalogLoader.doKerberosAuthentication() when either the Kerberos principal or the keytab path is blank. Instead of attempting a (guaranteed-to-fail) login, the method skips Kerberos entirely and logs which fields were empty; the Hadoop configuration is left non-kerberized, so access to secured resources will likely fail later with permission errors.

Source

Thrown at seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java:160

                System.setProperty("krb.principal", kerberosPrincipal);
                doKerberosAuthentication(configuration, kerberosPrincipal, kerberosKeytabPath);
            } catch (Exception e) {
                throw new IcebergConnectorException(
                        CommonErrorCode.KERBEROS_AUTHORIZED_FAILED,
                        String.format("Kerberos authentication failed: %s", e.getMessage()));
            }
        } else {
            log.warn(
                    "Kerberos authentication is not configured, it will skip kerberos authentication");
        }

        return configuration;
    }

    public static void doKerberosAuthentication(
            Configuration configuration, String principal, String keytabPath) {
        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {
            log.warn(
                    "Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication",
                    principal,
                    keytabPath);
        } else {
            configuration.set("hadoop.security.authentication", "kerberos");
            UserGroupInformation.setConfiguration(configuration);
            try {
                log.info(
                        "Start Kerberos authentication using principal {} and keytab {}",
                        principal,
                        keytabPath);
                UserGroupInformation.loginUserFromKeytab(principal, keytabPath);
                UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
                log.info("Kerberos authentication successful,UGI {}", loginUser);
            } catch (IOException e) {
                throw new SeaTunnelException("check connectivity failed, " + e.getMessage(), e);
            }
        }

View on GitHub (pinned to cf67b549a7)

Solutions

Set BOTH the Kerberos principal and keytab path options to non-empty values in the Iceberg catalog/sink config.
Verify the option keys are the ones the connector reads (a typo yields blank values silently); print/log the resolved values to confirm.
If Kerberos is not required, explicitly leave both unset so the skip is intentional rather than an accident.

Example fix

// before
kerberos_principal = "user@EXAMPLE.COM"
# keytab missing -> skip warning
// after
kerberos_principal = "user@EXAMPLE.COM"
kerberos_keytab_path = "/etc/security/keytabs/user.keytab"

Defensive patterns

Strategy: validation

Validate before calling

if (principal == null || principal.isBlank() || keytabPath == null || keytabPath.isBlank()) {
    throw new IllegalArgumentException("Both kerberos principal and keytabPath must be non-empty for Kerberos auth");
}
if (!Files.isReadable(Paths.get(keytabPath))) throw new IllegalArgumentException("keytab not readable: " + keytabPath);

Prevention

Always set principal AND keytab path together; a typo in either key silently yields blank values
Check file existence/readability of the keytab before submitting the job
Interpolate env vars carefully — unresolved variables become empty strings
If Kerberos is not needed, leave both options unset deliberately

When it happens

Trigger: doKerberosAuthentication(configuration, principal, keytabPath) is called (from doKerberosLogin) with an empty/whitespace principal or keytabPath; StringUtils.isBlank catches it and logs this warning instead of setting hadoop.security.authentication=kerberos.

Common situations: Only one of principal/keytab configured (the other forgotten or misnamed option so it resolves to null/empty); empty-string options in HOCON config; env-var-driven configs where the variable was not substituted.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/seatunnel@cf67b549a7 (2026-09-10). Data as JSON: /api/errors/edee6ee61fc929ee. Report an issue: GitHub.