{"record":{"id":"53e2161c6d0f6c0c","repo":"apache/hadoop","slug":"sasl-is-configured-for-registry-but-neither-keyta","errorCode":null,"errorMessage":"SASL is configured for registry, but neither keytab/principal nor java.security.auth.login.config system property are specified","messagePattern":"SASL is configured for registry, but neither keytab/principal nor java\\.security\\.auth\\.login\\.config system property are specified","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":759,"sourceCode":"\n    if (isSecureRegistry()) {\n      switch (access) {\n        case anon:\n          clearZKSaslClientProperties();\n          break;\n\n        case digest:\n          // no SASL\n          clearZKSaslClientProperties();\n          builder.authorization(SCHEME_DIGEST, digestAuthData);\n          break;\n\n        case sasl:\n          String existingJaasConf = System.getProperty(\n              \"java.security.auth.login.config\");\n          if (existingJaasConf == null || existingJaasConf.isEmpty()) {\n            if (principal == null || keytab == null) {\n              throw new IOException(\"SASL is configured for registry, \" +\n                  \"but neither keytab/principal nor java.security.auth.login\" +\n                  \".config system property are specified\");\n            }\n            // in this case, keytab and principal are specified and no jaas\n            // config is specified, so we will create one\n            LOG.info(\n                \"Enabling ZK sasl client: jaasClientEntry = \" + jaasClientEntry\n                    + \", principal = \" + principal + \", keytab = \" + keytab);\n            JaasConfiguration jconf =\n                new JaasConfiguration(jaasClientEntry, principal, keytab);\n            javax.security.auth.login.Configuration.setConfiguration(jconf);\n            setSystemPropertyIfUnset(ZKClientConfig.ENABLE_CLIENT_SASL_KEY,\n                                     \"true\");\n            setSystemPropertyIfUnset(ZKClientConfig.LOGIN_CONTEXT_NAME_KEY,\n                                     jaasClientEntry);\n          } else {\n            // in this case, jaas config is specified so we will not change it\n            LOG.info(\"Using existing ZK sasl configuration: \" +","sourceCodeStart":741,"sourceCodeEnd":777,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L741-L777","documentation":"In SASL mode RegistrySecurity.applySecurityEnvironment needs a JAAS configuration for the Curator client. If the java.security.auth.login.config system property is unset/empty AND no registry Kerberos principal+keytab were supplied (fields set only via setKerberosPrincipalAndKeytab), it cannot build or find a JAAS configuration and throws this IOException stating exactly that. Note the two escape hatches it checks: an external JAAS file, or principal+keytab from which it generates an in-memory JaasConfiguration.","triggerScenarios":"client.auth=kerberos on a JVM without the JAAS system property, on a CuratorService/RegistryOperationsService whose setKerberosPrincipalAndKeytab was never called — e.g. a custom registry client that skips the keytab wiring YARN's own client normally performs.","commonSituations":"Custom registry tooling that configures SASL but relies on a JAAS file that deployment no longer passes; containerized services where -Djava.security.auth.login.config was dropped from JVM options; test harnesses moving from jaas-file auth to keytab auth half-way.","solutions":["Set -Djava.security.auth.login.config=/path/jaas.conf with a file that defines the hadoop.registry.jaas.context entry (default 'Client').","Or call curatorService.setKerberosPrincipalAndKeytab(principal, keytabPath) before start so an in-memory JaasConfiguration is generated (the branch right after this check).","If the property is set but the entry is missing, you will hit validateContext instead — fix the file contents per that error."],"exampleFix":"// before: SASL registry client, no JAAS property and no keytab/principal wired\nRegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, null, null);\n\n// after: provide a JAAS config file, or supply principal + keytab\nSystem.setProperty(\"java.security.auth.login.config\", \"/etc/security/jaas.conf\");\nRegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytabPath);","handlingStrategy":"validation","validationCode":"// pre-flight for SASL registry clients\nboolean hasJaasFile = StringUtils.isNotEmpty(\n    System.getProperty(\"java.security.auth.login.config\"));\nboolean hasKeytab = principal != null && keytab != null;\nif (!hasJaasFile && !hasKeytab) {\n  throw new IllegalStateException(\n      \"SASL registry needs either -Djava.security.auth.login.config or kerberos principal+keytab\");\n}\n// if no file: wire the keytab so an in-memory JaasConfiguration is generated\ncuratorService.setKerberosPrincipalAndKeytab(principal, keytabPath);","typeGuard":null,"tryCatchPattern":"try {\n  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"neither keytab/principal nor java.security.auth.login.config\")) {\n    // set the JAAS system property or pass principal/keytab so a JaasConfiguration can be built\n  }\n}","preventionTips":["Pass -Djava.security.auth.login.config in every JVM that uses SASL registry, and verify it in deployment smoke tests.","Alternatively always wire principal+keytab via setKerberosPrincipalAndKeytab / the factory method.","Treat this error as the 'no JAAS source at all' case: if the file exists but the entry is missing you get the validateContext error instead."],"tags":["registry","sasl","jaas","kerberos","zookeeper","configuration","hadoop-registry"],"backgroundTag":"jaas-config-missing","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}