{"record":{"id":"25daa22a58961d6a","repo":"juicedata/juicefs","slug":"generate-kerberos-ap-req-failed","errorCode":null,"errorMessage":"generate kerberos  AP-REQ failed","messagePattern":"generate kerberos  AP-REQ failed","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java","lineNumber":2351,"sourceCode":"    try {\n      Class<AclStatus.Builder> ab = AclStatus.Builder.class;\n      Method abm = ab.getDeclaredMethod(\"setPermission\", FsPermission.class);\n      abm.setAccessible(true);\n      abm.invoke(builder, st.getPermission());\n    } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException ignored) {\n    }\n    return builder.build();\n  }\n\n  public AuthCredential buildAuthCredential(String spn) throws IOException {\n    // auth use kerberos, only when the server principal is configured\n    if (spn != null && !spn.isEmpty() && UserGroupInformation.getLoginUser().hasKerberosCredentials()) {\n      dtEnabled = true;\n      byte[] cred;\n      try {\n        cred = KerberosUtil.genApReq(spn);\n      } catch (InterruptedException e) {\n        throw new IOException(\"generate kerberos  AP-REQ failed\", e);\n      }\n      return new AuthCredential(\"kerberos\", cred);\n    }\n\n    // auth use delegation token\n    for (Token<? extends TokenIdentifier> token : ugi.getCredentials().getAllTokens()) {\n      if (token.getKind().equals(JuiceFSDelegationTokenIdentifier.TOKEN_KIND) &&\n          buildServiceName().equals(token.getService().toString())) {\n        dtEnabled = true;\n\n        AbstractDelegationTokenIdentifier identifier = (AbstractDelegationTokenIdentifier) token.decodeIdentifier();\n        int id = identifier.getMasterKeyId();\n        byte[] password = token.getPassword();\n        ByteBuffer buf = ByteBuffer.allocate(8 + password.length);\n        buf.putInt(id);\n        buf.putInt(password.length);\n        buf.put(password);\n","sourceCodeStart":2333,"sourceCodeEnd":2369,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java#L2333-L2369","documentation":"Thrown in buildAuthCredential when the client, configured with a Kerberos service principal name, fails to generate the AP-REQ token needed for the initial JuiceFS authentication handshake. It means the JVM Kerberos setup could not produce a service ticket for the given SPN (missing TGT, wrong principal, or clock/KDC problems).","triggerScenarios":"Thrown at sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java:2351 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify kinit was performed and a valid TGT exists for the login user","Check that the configured service principal (juicefs.metadata-service-principal) matches the KDC principal exactly, including realm"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}