{"record":{"id":"5084b055a488613e","repo":"apache/hadoop","slug":"invalid-server-principal-serverprincipal-decoded","errorCode":null,"errorMessage":"Invalid server principal ${serverPrincipal}decoded from client request","messagePattern":"Invalid server principal (.+?)decoded from client request","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":401,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java","lineNumber":333,"sourceCode":"      response.setHeader(WWW_AUTHENTICATE, KerberosAuthenticator.NEGOTIATE);\n      response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);\n      if (authorization == null) {\n        LOG.trace(\"SPNEGO starting for url: {}\", request.getRequestURL());\n      } else {\n        LOG.warn(\"'\" + KerberosAuthenticator.AUTHORIZATION +\n            \"' does not start with '\" +\n            KerberosAuthenticator.NEGOTIATE + \"' :  {}\", authorization);\n      }\n    } else {\n      authorization = authorization.substring(\n          KerberosAuthenticator.NEGOTIATE.length()).trim();\n      final Base64 base64 = new Base64(0);\n      final byte[] clientToken = base64.decode(authorization);\n      try {\n        final String serverPrincipal =\n            KerberosUtil.getTokenServerName(clientToken);\n        if (!serverPrincipal.startsWith(\"HTTP/\")) {\n          throw new IllegalArgumentException(\n              \"Invalid server principal \" + serverPrincipal +\n              \"decoded from client request\");\n        }\n        token = Subject.doAs(serverSubject,\n            new PrivilegedExceptionAction<AuthenticationToken>() {\n              @Override\n              public AuthenticationToken run() throws Exception {\n                return runWithPrincipal(serverPrincipal, clientToken,\n                      base64, response);\n              }\n            });\n      } catch (PrivilegedActionException ex) {\n        if (ex.getException() instanceof IOException) {\n          throw (IOException) ex.getException();\n        } else {\n          throw new AuthenticationException(ex.getException());\n        }\n      } catch (Exception ex) {","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java#L315-L351","documentation":"Error \"Invalid server principal ${serverPrincipal}decoded from client request\" thrown in apache/hadoop.","triggerScenarios":"Raised at runtime when the documented precondition or configuration requirement for this operation is violated.","commonSituations":"Misconfigured or missing property, invalid user input, or calling the API before its prerequisites are met.","solutions":["Verify the client request carries a valid Kerberos service ticket and that the server's JAAS/keytab setup matches the expected server principal."],"exampleFix":"kinit and retry; ensure SPN HTTP/fqdn@REALM matches keytab.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}