{"record":{"id":"537dce89f0e8e0b4","repo":"juicedata/juicefs","slug":"problem-with-kerberos-authentication-s","errorCode":null,"errorMessage":"Problem with kerberos authentication: %s","messagePattern":"Problem with kerberos authentication: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/object/hdfs.go","lineNumber":316,"sourceCode":"}\n\nfunc newHDFS(addr, username, sk, token string) (ObjectStorage, error) {\n\tconf, err := hadoopconf.LoadFromEnvironment()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Problem loading configuration: %s\", err)\n\t}\n\n\trpcAddr, basePath := parseHDFSAddr(addr, conf)\n\toptions := hdfs.ClientOptionsFromConf(conf)\n\tif addr != \"\" {\n\t\toptions.Addresses = rpcAddr\n\t\tlogger.Infof(\"HDFS Addresses: %s, basePath: %s\", rpcAddr, basePath)\n\t}\n\n\tif options.KerberosClient != nil {\n\t\toptions.KerberosClient, err = getKerberosClient()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Problem with kerberos authentication: %s\", err)\n\t\t}\n\t} else {\n\t\tif username == \"\" {\n\t\t\tusername = os.Getenv(\"HADOOP_USER_NAME\")\n\t\t}\n\t\tif username == \"\" {\n\t\t\tcurrent, err := user.Current()\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"get current user: %s\", err)\n\t\t\t}\n\t\t\tusername = current.Username\n\t\t}\n\t\toptions.User = username\n\t}\n\n\tc, err := hdfs.NewClient(options)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"new HDFS client %s: %s\", rpcAddr, err)","sourceCodeStart":298,"sourceCodeEnd":334,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/object/hdfs.go#L298-L334","documentation":"When the Hadoop configuration enables Kerberos (hadoop.security.authentication=kerberos, detected via options.KerberosClient != nil), newHDFS obtains a Kerberos client through getKerberosClient(). If keytab/ccache acquisition or login fails, the error is wrapped as \"Problem with kerberos authentication: %s\". The HDFS client cannot be created without a valid Kerberos identity.","triggerScenarios":"newHDFS called with a Kerberized cluster while KRB5KEYTAB/KRB5PRINCIPAL (or base64 keytab) env vars are missing, wrong, or expired; kinit credentials absent; the keytab unmarshal or krb5 client login returns an error.","commonSituations":"Deploying JuiceFS on a secure Hadoop cluster without running kinit; service principal typo in KRB5PRINCIPAL; expired ticket cache; missing krb5.conf; wrong realm in the principal.","solutions":["Check the wrapped inner error and fix accordingly (missing keytab, bad principal, no ccache).","Run kinit with the service principal before starting JuiceFS, or set KRB5KEYTAB and KRB5PRINCIPAL (e.g. KRB5PRINCIPAL=hdfs/host@REALM) to the keytab path and correct principal.","Verify /etc/krb5.conf is present and the KDC is reachable (kinit works interactively).","Confirm the keytab contains an entry for the given principal: klist -kte /path/to/keytab."],"exampleFix":"// before\n$ ./juicefs mount hdfs://nn:9000/data /mnt/jfs   # Kerberized cluster, no kinit\nProblem with kerberos authentication: no credentials found\n// after\n$ kinit -kt /etc/security/keytabs/juicefs.service.keytab juicefs/host@EXAMPLE.COM\n$ ./juicefs mount hdfs://nn:9000/data /mnt/jfs","handlingStrategy":"validation","validationCode":"if os.Getenv(\"HADOOP_SECURITY_AUTHENTICATION\") == \"kerberos\" {\n    if os.Getenv(\"KRB5KEYTAB\") == \"\" && os.Getenv(\"KRB5CCNAME\") == \"\" {\n        return errors.New(\"kerberized cluster: set KRB5KEYTAB+KRB5PRINCIPAL or kinit first\")\n    }\n}","typeGuard":null,"tryCatchPattern":"os, err := object.CreateStorage(\"hdfs\", addr, \"\", \"\")\nif err != nil && strings.Contains(err.Error(), \"Problem with kerberos authentication\") {\n    logger.Fatalf(\"Kerberos auth failed: %v — run kinit or fix KRB5KEYTAB/KRB5PRINCIPAL\", err)\n}","preventionTips":["Run kinit (or use a keytab) before starting JuiceFS on a secure cluster.","Verify keytab principals with klist -kte.","Monitor ticket expiry and refresh tickets in long-running deployments (cron kinit -R).","Keep /etc/krb5.conf present and KDC reachable; test with kinit in CI."],"tags":["hdfs","kerberos","authentication","object-storage"],"backgroundTag":"authentication-required","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}