{"record":{"id":"56651c229da83b97","repo":"t8y2/dbx","slug":"zookeeper-kerberos-sasl-requires-hive-kerberos-cre-56651c","errorCode":null,"errorMessage":"ZooKeeper Kerberos SASL requires Hive Kerberos credentials","messagePattern":"ZooKeeper Kerberos SASL requires Hive Kerberos credentials","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/zookeeper_protocol.go","lineNumber":96,"sourceCode":"\toptions.CanonicalizeHost = config.ZooKeeperKerberos.CanonicalHostname\n\toptions.ServerName = config.ZooKeeperKerberos.ServerPrincipal\n\tif options.ServerName == \"\" && config.ZooKeeperKerberos.Realm != \"\" {\n\t\toptions.ServerName = service + \"/_HOST@\" + config.ZooKeeperKerberos.Realm\n\t}\n\treturn service, options\n}\n\nfunc connectKerberosZooKeeper(\n\tservers []string,\n\ttimeout time.Duration,\n\ttlsConfig *tls.Config,\n\tconfig connectionConfig,\n) (zooKeeperClient, <-chan zk.Event, error) {\n\tif len(servers) == 0 {\n\t\treturn nil, nil, errors.New(\"ZooKeeper server list is empty\")\n\t}\n\tif !config.Kerberos.Enabled {\n\t\treturn nil, nil, errors.New(\"ZooKeeper Kerberos SASL requires Hive Kerberos credentials\")\n\t}\n\tordered := append([]string(nil), servers...)\n\tshuffleZooKeeperServers(ordered)\n\tvar failures []string\n\tfor _, address := range ordered {\n\t\thost, _, err := net.SplitHostPort(address)\n\t\tif err != nil {\n\t\t\tfailures = append(failures, fmt.Sprintf(\"%s: %v\", address, err))\n\t\t\tcontinue\n\t\t}\n\t\tconnection, err := dialZooKeeperConnection(address, timeout, tlsConfig)\n\t\tif err != nil {\n\t\t\tfailures = append(failures, fmt.Sprintf(\"%s: %v\", address, err))\n\t\t\tcontinue\n\t\t}\n\t\tclient, err := newProtocolZooKeeperClient(connection, timeout)\n\t\tif err == nil {\n\t\t\tvar saslClient zooKeeperSASLClient","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/zookeeper_protocol.go#L78-L114","documentation":"Kerberos-based ZooKeeper SASL requires Hive Kerberos credentials to run the GSSAPI negotiation. If config.Kerberos.Enabled is false, connectKerberosZooKeeper refuses to proceed because a plain connection would be rejected by a SASL-required ensemble (cf. code -124).","triggerScenarios":"Calling connectKerberosZooKeeper with a connectionConfig whose Kerberos.Enabled is false — Kerberos section omitted from config, disabled flag not set, or config not populated from the connection string.","commonSituations":"Using a service (Hive) that requires SASL ZooKeeper but deploying without keytab/principal configuration; config file has kerberos stanza but Enabled flag left false; environment variable wiring skipped during deployment.","solutions":["Set Kerberos.Enabled=true along with a valid Principal and Keytab in connectionConfig","Provide the keytab file and ensure the principal exists in the KDC and is permitted by the ZooKeeper/Hive service","Verify the config loader actually populates config.Kerberos from your connection string/env","If SASL is not required, use the non-Kerberos connect path instead of connectKerberosZooKeeper"],"exampleFix":"// before\ncfg := connectionConfig{Hosts: servers} // Kerberos zero-value: Enabled=false\nconn, err := connectKerberosZooKeeper(ctx, servers, timeout, tls, cfg)\n// after\ncfg := connectionConfig{Hosts: servers}\ncfg.Kerberos.Enabled = true\ncfg.Kerberos.Principal = \"hive/_HOST@EXAMPLE.COM\"\ncfg.Kerberos.Keytab = \"/etc/security/keytabs/hive.keytab\"\nconn, err := connectKerberosZooKeeper(ctx, servers, timeout, tls, cfg)","handlingStrategy":"validation","validationCode":"// Go\nfunc kerberosReady(cfg connectionConfig) error {\n    if !cfg.Kerberos.Enabled {\n        return errors.New(\"kerberos must be enabled for SASL ZooKeeper\")\n    }\n    if cfg.Kerberos.Principal == \"\" || cfg.Kerberos.Keytab == \"\" {\n        return errors.New(\"kerberos principal and keytab are required\")\n    }\n    if _, err := os.Stat(cfg.Kerberos.Keytab); err != nil {\n        return fmt.Errorf(\"keytab missing: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Template deployments so Kerberos.Enabled, Principal, Keytab are always set together","Check keytab file readability at boot (kinit -k -t) before connecting","Keep one config source of truth for Kerberos settings across Hive and ZooKeeper"],"tags":["zookeeper","kerberos","sasl","configuration"],"backgroundTag":"sasl-authentication-required","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}