{"record":{"id":"0c8a1190f669f29a","repo":"apache/seatunnel","slug":"kerberos-authentication-failed","errorCode":"KERBEROS_AUTHENTICATION_FAILED","errorMessage":"Kerberos authentication failed using this principal [%s] and keytab path [%s]","messagePattern":"Kerberos authentication failed using this principal \\[(.+?)\\] and keytab path \\[(.+?)\\]","errorType":"error_code","errorClass":"JdbcConnectorException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-jdbc/src/main/java/org/apache/seatunnel/connectors/seatunnel/jdbc/utils/HiveJdbcUtils.java","lineNumber":65,"sourceCode":"                    principal,\n                    keytabPath);\n        } else {\n            configuration.set(\"hadoop.security.authentication\", \"kerberos\");\n            UserGroupInformation.setConfiguration(configuration);\n            try {\n                log.info(\n                        \"Start Kerberos authentication using principal {} and keytab {}\",\n                        principal,\n                        keytabPath);\n                UserGroupInformation.loginUserFromKeytab(principal, keytabPath);\n                log.info(\"Kerberos authentication successful\");\n            } catch (IOException e) {\n                String errorMsg =\n                        String.format(\n                                \"Kerberos authentication failed using this \"\n                                        + \"principal [%s] and keytab path [%s]\",\n                                principal, keytabPath);\n                throw new JdbcConnectorException(KERBEROS_AUTHENTICATION_FAILED, errorMsg, e);\n            }\n        }\n    }\n}\n","sourceCodeStart":47,"sourceCodeEnd":70,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-jdbc/src/main/java/org/apache/seatunnel/connectors/seatunnel/jdbc/utils/HiveJdbcUtils.java#L47-L70","documentation":"Hive JDBC sources support Kerberos authentication using a principal and keytab. When UserGroupInformation.loginUserFromKeytab (or equivalent) throws an IOException, this error wraps it, reporting which principal and keytab path failed. It signals the Kerberos login itself failed — bad credentials, unreadable keytab, or no Kerberos configuration on the JVM.","triggerScenarios":"doKerberosAuthentication is invoked when Kerberos is enabled for a Hive/other Kerberized JDBC connection and loginUserFromKeytab throws IOException: keytab file missing/unreadable, principal not present in keytab, clock skew, or missing krb5.conf/JAAS setup.","commonSituations":"Wrong principal spelling (must match keytab entry exactly, realm included); keytab path not accessible from all cluster nodes; KDC unreachable; HADOOP/Kerberos configs not distributed to worker nodes; expired keytab after password rotation.","solutions":["Verify the keytab file exists and is readable by the process user on every node (klist -kt /path/to/keytab)","Confirm the principal exactly matches an entry in the keytab (kinit -kt keytab principal) and the realm matches krb5.conf","Set JVM Kerberos config (java.security.krb5.conf, useKeyTabTicket) and ensure HADOOP security configs are on the classpath","Check KDC reachability and clock sync (NTP); regenerate the keytab if credentials were rotated"],"exampleFix":"// before\nurl = \"jdbc:hive2://host:10000/db\";\n// Kerberos flags omitted -> fails or misconfigures\n// after\nJdbcConnectionConfig cfg = JdbcConnectionConfig.builder()\n    .setUrl(\"jdbc:hive2://host:10000/db;principal=hive/_HOST@REALM\")\n    .setKerberosPrincipal(\"user@EXAMPLE.COM\")\n    .setKerberosKeytabPath(\"/etc/security/keytabs/user.keytab\")\n    .build(); // ensure keytab is readable and principal matches `klist -kt`","handlingStrategy":"try-catch","validationCode":"import java.io.File;\nif (keytabPath == null || !new File(keytabPath).canRead()) throw new IllegalStateException(\"Keytab unreadable: \" + keytabPath);\n// principal should match a `klist -kt keytab` entry exactly\nProcess kinit = new ProcessBuilder(\"kinit\", \"-kt\", keytabPath, principal).inheritIO();\nif (kinit.start().waitFor() != 0) throw new IllegalStateException(\"kinit failed for \" + principal);","typeGuard":null,"tryCatchPattern":"try {\n  hiveUtils.doKerberosAuthentication(principal, keytabPath);\n} catch (JdbcConnectorException e) {\n  if (\"KERBEROS_AUTHENTICATION_FAILED\".equals(String.valueOf(e.getCode()))) {\n    log.error(\"Check principal/keytab: {}\", e.getMessage());\n    // validate keytab with klist -kt, retry once after checking KDC\n  }\n}","preventionTips":["Validate keytab with klist -kt and principal match before deploying","Distribute keytab and krb5.conf to every node and ensure read permissions","Regenerate keytabs after password rotation; monitor expiry","Keep KDC reachable and NTP-synchronized"],"tags":["kerberos","authentication","jdbc","security"],"backgroundTag":"kerberos-authentication-failed","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}