{"record":{"id":"0b7ca0ac7af6afb3","repo":"apache/seatunnel","slug":"kerberos-authorized-failed","errorCode":"KERBEROS_AUTHORIZED_FAILED","errorMessage":"Kerberos Authorized Fail!","messagePattern":"Kerberos Authorized Fail!","errorType":"error_code","errorClass":"HudiConnectorException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-hudi/src/main/java/org/apache/seatunnel/connectors/seatunnel/hudi/util/HudiUtil.java","lineNumber":134,"sourceCode":"        }\n        return new SeaTunnelRowType(fields, types);\n    }\n\n    public static JobConf toJobConf(Configuration conf) {\n        if (conf instanceof JobConf) {\n            return (JobConf) conf;\n        }\n        return new JobConf(conf);\n    }\n\n    public static void initKerberosAuthentication(\n            Configuration conf, String principal, String principalFile)\n            throws HudiConnectorException {\n        try {\n            UserGroupInformation.setConfiguration(conf);\n            UserGroupInformation.loginUserFromKeytab(principal, principalFile);\n        } catch (IOException e) {\n            throw new HudiConnectorException(\n                    CommonErrorCodeDeprecated.KERBEROS_AUTHORIZED_FAILED,\n                    \"Kerberos Authorized Fail!\",\n                    e);\n        }\n    }\n\n    public static HoodieJavaWriteClient<HoodieAvroPayload> createHoodieJavaWriteClient(\n            HudiSinkConfig hudiSinkConfig, SeaTunnelRowType seaTunnelRowType, String tableName) {\n        List<HudiTableConfig> tableList = hudiSinkConfig.getTableList();\n        Optional<HudiTableConfig> hudiTableConfig =\n                tableList.stream()\n                        .filter(table -> table.getTableName().equals(tableName))\n                        .findFirst();\n        if (!hudiTableConfig.isPresent()) {\n            throw new HudiConnectorException(\n                    TABLE_CONFIG_NOT_FOUND,\n                    \"The corresponding table \"\n                            + tableName","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-hudi/src/main/java/org/apache/seatunnel/connectors/seatunnel/hudi/util/HudiUtil.java#L116-L152","documentation":"HudiUtil.initKerberosAuthentication wraps UserGroupInformation.loginUserFromKeytab failures in a HudiConnectorException with KERBEROS_AUTHORIZED_FAILED. The login itself (reading the keytab, contacting the KDC, building the UGI configuration) threw an IOException, so Kerberos authentication could not be established.","triggerScenarios":"initKerberosAuthentication is called with a Hadoop Configuration, a principal, and a keytab principalFile; UserGroupInformation.setConfiguration(conf) or loginUserFromKeytab(principal, principalFile) throws IOException.","commonSituations":"Keytab file path wrong or file unreadable by the SeaTunnel process; principal name does not match an entry in the keytab (kinit -kt fails); KDC unreachable / DNS resolution of realm hosts failing; clock skew between client and KDC; missing hdfs-site.xml/core-site.xml in confFilesPath so the UGI config lacks auth settings; encrypted-keytab-not-supported JCE issues.","solutions":["Verify the keytab file exists and is readable by the SeaTunnel worker user: klist -kt <principalFile> and test with kinit -kt <principalFile> <principal>.","Confirm the principal exactly matches an entry in the keytab (klist -k output), including realm casing.","Ensure the Hadoop conf directory (core-site.xml, hdfs-site.xml) listed in hudi_sink conf_files_path is accessible and contains kerberos settings.","Check KDC reachability and clock sync (ntp/chronyd); enable Hadoop debug via HADOOP_JAAS_DEBUG=true or -Dsun.security.krb5.debug=true to see the failure cause.","Increase the SeaTunnel JVM memory for large UGI configs is not needed — instead confirm io retries; then re-run the job."],"exampleFix":"// before\nhudi {\n  kerberos_principal = \"user@EXAMPLE.COM\"\n  kerberos_keytab_path = \"/etc/security/keytab/user.keytab\"\n}\n// after (verify with kinit first; fix principal/keytab mismatch)\n# kinit -kt /etc/security/keytab/user.keytab user@EXAMPLE.COM\nhudi {\n  kerberos_principal = \"user@EXAMPLE.COM\"\n  kerberos_keytab_path = \"/etc/security/keytab/user.keytab\"  # must exist on every node\n}","handlingStrategy":"validation","validationCode":"// shell pre-check before submitting the job\nklist -kt /etc/security/keytab/user.keytab && kinit -kt /etc/security/keytab/user.keytab user@EXAMPLE.COM\n// java: check readability\nFile keytab = new File(principalFile);\nif (!keytab.canRead()) throw new IllegalStateException(\"keytab unreadable: \" + principalFile);","typeGuard":null,"tryCatchPattern":"try {\n    initKerberosAuthentication(conf, principal, keytabPath);\n} catch (HudiConnectorException e) {\n    LOG.error(\"Kerberos login failed for principal {} with keytab {}\", principal, keytabPath, e);\n    throw e; // auth failure should fail fast\n}","preventionTips":["Test kinit with the exact principal+keytab on every worker node before deploying.","Keep keytab paths identical and readable across all SeaTunnel nodes.","Sync clocks with NTP/chrony to avoid KDC preauth failures.","Include core-site.xml/hdfs-site.xml in conf_files_path."],"tags":["kerberos","authentication","hadoop","hudi"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}