{"record":{"id":"56d5ab6c237f40d1","repo":"apache/hadoop","slug":"kerberos-required-for-secure-registry-access","errorCode":null,"errorMessage":"Kerberos required for secure registry access","messagePattern":"Kerberos required for secure registry access","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":273,"sourceCode":"                              DEFAULT_REGISTRY_USER_ACCOUNTS);\n      List<ACL> userACLs = buildACLs(user, kerberosRealm, ZooDefs.Perms.ALL);\n\n      // add self if the current user can be determined\n      ACL self;\n      if (UserGroupInformation.isSecurityEnabled()) {\n        self = createSaslACLFromCurrentUser(ZooDefs.Perms.ALL);\n        if (self != null) {\n          userACLs.add(self);\n        }\n      }\n      LOG.info(\"Registry User ACLs \" + System.lineSeparator()+ userACLs);\n\n      // here check for UGI having secure on or digest + ID\n      switch (access) {\n        case sasl:\n          // secure + SASL => has to be authenticated\n          if (!UserGroupInformation.isSecurityEnabled()) {\n            throw new IOException(\"Kerberos required for secure registry access\");\n          }\n          UserGroupInformation currentUser =\n              UserGroupInformation.getCurrentUser();\n          jaasClientEntry = getOrFail(KEY_REGISTRY_CLIENT_JAAS_CONTEXT,\n              DEFAULT_REGISTRY_CLIENT_JAAS_CONTEXT);\n          jaasClientIdentity = currentUser.getShortUserName();\n          if (LOG.isDebugEnabled()) {\n            LOG.debug(\"Auth is SASL user=\\\"{}\\\" JAAS context=\\\"{}\\\"\",\n                jaasClientIdentity, jaasClientEntry);\n          }\n          break;\n\n        case digest:\n          String id = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_ID, \"\");\n          String pass = getOrFail(KEY_REGISTRY_CLIENT_AUTHENTICATION_PASSWORD, \"\");\n          if (userACLs.isEmpty()) {\n            //\n            throw new ServiceStateException(E_NO_USER_DETERMINED_FOR_ACLS);","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L255-L291","documentation":"With client.auth=kerberos (SASL policy), RegistrySecurity.initSecurity requires that Hadoop security is already active in this JVM: UserGroupInformation.isSecurityEnabled() must be true, meaning UGI was initialized with a Configuration where hadoop.security.authentication=kerberos. If not, it throws IOException('Kerberos required for secure registry access') because SASL authentication has no credentials to draw on.","triggerScenarios":"Creating a kerberos registry client while UGI still reflects hadoop.security.authentication=simple (setConfiguration never called with the secure conf, or called after client creation); unit tests without Kerberos infrastructure; secure registry config applied in an insecure cluster.","commonSituations":"core-site.xml still on authentication=simple while registry client config says kerberos; config ordering bugs where UserGroupInformation is initialized before the secure Configuration is loaded; dev environments cloned from secure clusters.","solutions":["Set hadoop.security.authentication=kerberos and call UserGroupInformation.setConfiguration(conf) before creating the registry client.","Log in via kinit or UserGroupInformation.loginUserFromKeytab so a Kerberos UGI exists.","If the deployment is genuinely insecure, switch the registry client to anonymous/simple auth instead of kerberos."],"exampleFix":"// before\nconf.set(\"hadoop.registry.client.auth\", \"kerberos\"); // but hadoop.security.authentication=simple -> IOException\nRegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);\n\n// after: initialize Hadoop security first\nconf.set(\"hadoop.security.authentication\", \"kerberos\");\nUserGroupInformation.setConfiguration(conf);\nUserGroupInformation.loginUserFromKeytab(principal, keytabPath);\nRegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);","handlingStrategy":"validation","validationCode":"if (conf.get(\"hadoop.registry.client.auth\").equals(\"kerberos\")\n    && !UserGroupInformation.isSecurityEnabled()) {\n  throw new IllegalStateException(\n      \"Registry SASL requires Hadoop security: set hadoop.security.authentication=kerberos \"\n      + \"and UserGroupInformation.setConfiguration(conf) before creating the client\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);\n} catch (IOException e) {\n  if (e.getMessage().contains(\"Kerberos required\")) {\n    // initialize Hadoop security (setConfiguration + keytab login) or fall back to anonymous auth\n  }\n}","preventionTips":["Always call UserGroupInformation.setConfiguration(conf) with the final secure Configuration before creating secure registry clients.","Verify hadoop.security.authentication=kerberos in the effective config, not just the registry keys.","In insecure dev clusters, configure anonymous/simple registry auth rather than reusing kerberos settings."],"tags":["registry","kerberos","security","sasl","configuration","hadoop-registry"],"backgroundTag":"kerberos-not-enabled","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}