{"record":{"id":"62b0a5e05b4f1e1c","repo":"apache/pulsar","slug":"error-on-gssapi-boot","errorCode":null,"errorMessage":"error on GSSAPI boot","messagePattern":"error on GSSAPI boot","errorType":"exception","errorClass":"SaslException","httpStatus":null,"severity":"error","filePath":"pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/PulsarSaslServer.java","lineNumber":111,"sourceCode":"                    .log(\"SASL configuration\");\n\n                try {\n                    return Subject.doAs(subject, new PrivilegedExceptionAction<SaslServer>() {\n                            @Override\n                            public SaslServer run() {\n                                try {\n                                    SaslServer saslServer;\n                                    saslServer = Sasl.createSaslServer(GSSAPI, servicePrincipalName, serviceHostname,\n                                        null, callbackHandler);\n                                    return saslServer;\n                                } catch (SaslException e) {\n                                    throw new RuntimeException(e);\n                                }\n                            }\n                        }\n                    );\n                } catch (PrivilegedActionException e) {\n                    throw new SaslException(\"error on GSSAPI boot\", e.getCause());\n                }\n            } catch (IndexOutOfBoundsException e) {\n                throw new SaslException(\"error on GSSAPI boot\", e);\n            }\n        } else {\n            String errorMessage = \"Authentication use SASL/JAAS/GSSAPI but server not have Principals\";\n            log.error(errorMessage);\n            throw new SaslException(errorMessage);\n        }\n    }\n\n    public boolean isComplete() {\n        return saslServer.isComplete();\n    }\n\n    /**\n     * Reports the authorization ID in effect for the client of this\n     * session.","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/PulsarSaslServer.java#L93-L129","documentation":"PulsarSaslServer.createSaslServer failed while creating the GSSAPI SaslServer under the JAAS subject (Kerberos setup problem — missing keytab, principal, or JDK configuration), so the SASL handshake cannot start.","triggerScenarios":"Thrown at pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/PulsarSaslServer.java:111 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the broker's Kerberos keytab/principal and JAAS configuration","Check krb5.conf and that the service principal is resolvable via DNS"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}