{"record":{"id":"30f2c3c93a809981","repo":"apache/seatunnel","slug":"resetting-default-realm-failed-current-default-re","errorCode":null,"errorMessage":"resetting default realm failed, current default realm will still be used.","messagePattern":"resetting default realm failed, current default realm will still be used\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-kudu/src/main/java/org/apache/seatunnel/connectors/seatunnel/kudu/util/KuduUtil.java","lineNumber":148,"sourceCode":"        }\n        Configuration conf = new Configuration();\n        conf.set(HADOOP_AUTH_KEY, KRB);\n        UserGroupInformation.setConfiguration(conf);\n        log.info(\n                \"Start Kerberos authentication using principal {} and keytab {}\",\n                config.getPrincipal(),\n                config.getKeytab());\n        return UserGroupInformation.loginUserFromKeytabAndReturnUGI(\n                config.getPrincipal(), config.getKeytab());\n    }\n\n    private static void reloadKrb5conf(String krb5conf) {\n        System.setProperty(KRB5_CONF_KEY, krb5conf);\n        try {\n            Config.refresh();\n            KerberosName.resetDefaultRealm();\n        } catch (KrbException e) {\n            log.warn(\n                    \"resetting default realm failed, current default realm will still be used.\", e);\n        }\n    }\n\n    private static KuduClient getKuduClientInternal(\n            CommonConfig config, ExecutorService executorService) {\n        AsyncKuduClient.AsyncKuduClientBuilder builder =\n                new AsyncKuduClient.AsyncKuduClientBuilder(\n                                Arrays.asList(config.getMasters().split(\",\")))\n                        .workerCount(config.getWorkerCount())\n                        .defaultAdminOperationTimeoutMs(config.getAdminOperationTimeout())\n                        .defaultOperationTimeoutMs(config.getOperationTimeout());\n        if (executorService != null) {\n            builder.nioExecutor(executorService);\n        }\n        return builder.build().syncClient();\n    }\n","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-kudu/src/main/java/org/apache/seatunnel/connectors/seatunnel/kudu/util/KuduUtil.java#L130-L166","documentation":"KuduUtil.reloadKrb5conf sets the krb5.conf system property and then refreshes the JAAS/kerberos Config and resets the Hadoop KerberosName default realm. If org.ietf.jgss.GSSException/KrbException is thrown during refresh, the code logs a warning and continues with the previously loaded default realm, which may not match the new krb5.conf. The connector still uses the stale realm for Kerberos authentication.","triggerScenarios":"Calling loginAndReturnUgi with a kerberos principal/keytab when the new krb5.conf file is malformed, unreadable, or contains an invalid [libdefaults] default_realm entry, causing Config.refresh() or KerberosName.resetDefaultRealm() to throw KrbException.","commonSituations":"Pointing hadoop.security.authentication krb5 conf at a non-existent path, a krb5.conf copied from another cluster with a wrong default_realm, or a KDC change where the old realm stays cached in the JVM.","solutions":["Verify the krb5.conf path passed in config exists and is readable by the SeaTunnel process","Validate krb5.conf syntax (default_realm under [libdefaults]) with `kinit -k -t keytab principal` before running the job","Restart the JVM/node so the new krb5.conf takes effect from scratch if the stale realm persists","Ensure the principal's realm matches the default_realm in krb5.conf"],"exampleFix":"// before\nString krb5conf = \"/etc/krb5.conf.broken\"; // malformed file\nloginAndReturnUgi(principal, keytab, krb5conf);\n// after\nPath path = Paths.get(\"/etc/krb5.conf\");\nif (!Files.isReadable(path)) throw new IOException(\"krb5.conf missing: \" + path);\nloginAndReturnUgi(principal, keytab, path.toString());","handlingStrategy":"validation","validationCode":"java.nio.file.Path p = java.nio.file.Paths.get(krb5conf);\nif (!java.nio.file.Files.isReadable(p)) throw new IllegalStateException(\"krb5.conf not readable: \" + p);\n// pre-validate: kinit -k -t keytab principal must succeed outside the JVM","typeGuard":null,"tryCatchPattern":"try { loginAndReturnUgi(principal, keytab, krb5conf); } catch (Exception e) { throw new RuntimeException(\"Kerberos login failed (check krb5.conf default_realm)\", e); }","preventionTips":["Verify krb5.conf with kinit before running the job","Keep principal realm consistent with krb5.conf default_realm","Avoid hot-swapping krb5.conf in a long-lived JVM; restart instead"],"tags":["kerberos","kudu","authentication","config"],"backgroundTag":"invalid-config-value","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}