{"record":{"id":"302da2b57b70f83e","repo":"apache/seatunnel","slug":"authenticate-kerberos-failed","errorCode":"AUTHENTICATE_KERBEROS_FAILED","errorMessage":"Failed to login user from keytab : ${kerberosKeytabFilePath} and kerberos principal : ${kerberosPrincipal}","messagePattern":"Failed to login user from keytab : (.+?) and kerberos principal : (.+?)","errorType":"error_code","errorClass":"PaimonConnectorException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-paimon/src/main/java/org/apache/seatunnel/connectors/seatunnel/paimon/security/PaimonSecurityContext.java","lineNumber":131,"sourceCode":"        options.set(principalKey, kerberosPrincipal);\n        options.set(keytabKey, kerberosKeytabFilePath);\n        String ticketCacheKey = SecurityConfiguration.KERBEROS_LOGIN_USETICKETCACHE.key();\n        boolean ticketCache =\n                configuration.getBoolean(\n                        ticketCacheKey,\n                        SecurityConfiguration.KERBEROS_LOGIN_USETICKETCACHE.defaultValue());\n        options.set(ticketCacheKey, String.valueOf(ticketCache));\n        try {\n            CatalogContext catalogContext = CatalogContext.create(options, configuration);\n            if (StringUtils.isNotBlank(krb5Conf)) {\n                reloadKrb5conf(krb5Conf);\n            }\n            // refer: https://paimon.apache.org/docs/master/filesystems/hdfs/#kerberos.\n            // If the keytab is blank or principal is blank or keytabFile is not exists, the method\n            // of install will not perform kerberos authentication without any exception.\n            install(catalogContext);\n        } catch (Exception e) {\n            throw new PaimonConnectorException(\n                    PaimonConnectorErrorCode.AUTHENTICATE_KERBEROS_FAILED,\n                    \"Failed to login user from keytab : \"\n                            + kerberosKeytabFilePath\n                            + \" and kerberos principal : \"\n                            + kerberosPrincipal,\n                    e);\n        }\n    }\n\n    private static void reloadKrb5conf(String krb5conf) {\n        System.setProperty(KRB5_CONF_KEY, krb5conf);\n        try {\n            Config.refresh();\n            KerberosName.resetDefaultRealm();\n        } catch (KrbException e) {\n            log.warn(\n                    \"resetting default realm failed, current default realm will still be used.\", e);\n        }","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-paimon/src/main/java/org/apache/seatunnel/connectors/seatunnel/paimon/security/PaimonSecurityContext.java#L113-L149","documentation":"PaimonSecurityContext.verifyKerberosAuthentication wraps any exception from Paimon's Hadoop `UserGroupInformation.loginUserFromKeytab` (via `install`) into AUTHENTICATE_KERBEROS_FAILED. Paimon silently skips authentication when the keytab path is blank, the principal is blank, or the keytab file does not exist, so this error usually surfaces when login is attempted but fails.","triggerScenarios":"kerberos_keytab_path or kerberos_principal configured but wrong: keytab file missing/unreadable, principal not present in the keytab, wrong realm, clock skew, or KDC unreachable during `install(catalogContext)`.","commonSituations":"Keytab not distributed to all worker nodes; relative keytab path resolved against the wrong working directory; principal name mismatch (host vs _HOST substitution); expired keytab after password change; Kerberos realm typo.","solutions":["Verify the keytab file exists and is readable on every node: `ls -l <keytab>` / `klist -kt <keytab>`","Confirm the principal exactly matches an entry in the keytab (`klist -kt`) including realm","Use the absolute path for kerberos_keytab_path in the config","Test manually with `kinit -kt <keytab> <principal>` to surface KDC/clock issues","Check /etc/krb5.conf and NTP clock sync on the nodes"],"exampleFix":"// before\nkerberos_keytab_path = \"conf/user.keytab\" // relative, missing on workers\n// after\nkerberos_keytab_path = \"/etc/security/keytabs/user.keytab\"\nkerberos_principal = \"user/_HOST@REALM.COM\"\n","handlingStrategy":"validation","validationCode":"File keytab = new File(kerberosKeytabPath); if (!keytab.isFile() || !keytab.canRead() || kerberosPrincipal == null || kerberosPrincipal.isBlank()) { throw new IllegalStateException(\"Kerberos keytab/principal missing or unreadable\"); }","typeGuard":null,"tryCatchPattern":"try { securityContext.verifyKerberosAuthentication(); } catch (PaimonConnectorException e) { if (PaimonConnectorErrorCode.AUTHENTICATE_KERBEROS_FAILED.equals(e.getErrorCode())) { log.error(\"Kerberos login failed; check keytab/principal/KDC\", e); } else { throw e; } }","preventionTips":["Use absolute keytab paths valid on all nodes","Verify with klist -kt that the principal exists in the keytab","Keep keytabs rotated and krb5.conf/NTP consistent","Pre-flight kinit test before job submission"],"tags":["kerberos","authentication","hdfs"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}