{"record":{"id":"0e962c0ea703cf5a","repo":"apache/druid","slug":"principals-do-not-exist-in-the-keytab","errorCode":null,"errorMessage":"Principals do not exist in the keytab","messagePattern":"Principals do not exist in the keytab","errorType":"exception","errorClass":"ServletException","httpStatus":500,"severity":"critical","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java","lineNumber":96,"sourceCode":"      String principal = config.getProperty(PRINCIPAL);\n      if (principal == null || principal.trim().length() == 0) {\n        throw new ServletException(\"Principal not defined in configuration\");\n      }\n      keytab = config.getProperty(KEYTAB, keytab);\n      if (keytab == null || keytab.trim().length() == 0) {\n        throw new ServletException(\"Keytab not defined in configuration\");\n      }\n      if (!new File(keytab).exists()) {\n        throw new ServletException(\"Keytab does not exist: \" + keytab);\n      }\n\n      // use all SPNEGO principals in the keytab if a principal isn't\n      // specifically configured\n      final String[] spnegoPrincipals;\n      if (\"*\".equals(principal)) {\n        spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile(\"HTTP/.*\"));\n        if (spnegoPrincipals.length == 0) {\n          throw new ServletException(\"Principals do not exist in the keytab\");\n        }\n      } else {\n        spnegoPrincipals = new String[]{principal};\n      }\n\n      String nameRules = config.getProperty(NAME_RULES, null);\n      if (nameRules != null) {\n        KerberosName.setRules(nameRules);\n      }\n\n      for (String spnegoPrincipal : spnegoPrincipals) {\n        log.info(\"Login using keytab %s, for principal %s\", keytab, spnegoPrincipal);\n        final KerberosAuthenticator.DruidKerberosConfiguration kerberosConfiguration =\n            new KerberosAuthenticator.DruidKerberosConfiguration(keytab, spnegoPrincipal);\n        final LoginContext loginContext =\n            new LoginContext(\"\", serverSubject, null, kerberosConfiguration);\n        try {\n          loginContext.login();","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java#L78-L114","documentation":"When the configured principal is '*', the handler derives SPNEGO principals by scanning the keytab for names matching HTTP/.*. If no such HTTP service principals exist in the keytab, there is nothing to authenticate with, and init() throws a ServletException.","triggerScenarios":"init(Properties) with PRINCIPAL set to '*' and KerberosUtil.getPrincipalNames(keytab, HTTP/*.*) returning an empty array.","commonSituations":"Wildcard principal configured but keytab contains only non-HTTP principals (e.g. user or other service principals); keytab for the wrong service; kadmin exported principals with a different prefix than HTTP/.","solutions":["Add an HTTP/<host>@<REALM> principal to the keytab via kadmin ktadd","Or set an explicit principal (instead of '*') matching one present in the keytab","Verify keytab contents with 'klist -kt /path/to/keytab' and confirm an HTTP/ entry exists"],"exampleFix":"// before\nprops.setProperty(\"druid.auth.kerberos.serverPrincipal\", \"*\"); // keytab lacks HTTP/ principals\n// after\nprops.setProperty(\"druid.auth.kerberos.serverPrincipal\", \"HTTP/broker1.example.com@EXAMPLE.COM\");","handlingStrategy":"validation","validationCode":"String principalNames = new String(\n    java.nio.file.Files.readAllBytes(java.nio.file.Paths.get(keytab)),\n    java.nio.charset.StandardCharsets.ISO_8859_1);\n// verify with klist externally:\n// klist -kt /path/to/keytab | grep HTTP/","typeGuard":null,"tryCatchPattern":"try { handler.init(config); } catch (ServletException e) { if (\"Principals do not exist in the keytab\".equals(e.getMessage())) { log.error(\"Keytab lacks HTTP/ principals; run klist -kt\"); } throw e; }","preventionTips":["Run 'klist -kt' on the keytab before enabling wildcard ('*') principal mode","Only use '*' when the keytab is known to contain HTTP/ service principals","Prefer explicit principal names to avoid keytab-content dependency"],"tags":["kerberos","keytab","spnego"],"backgroundTag":"missing-credentials","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}