{"record":{"id":"633ade7cac226b8c","repo":"apache/hadoop","slug":"entry-s-not-found-jaas-config-s","errorCode":null,"errorMessage":"Entry \"%s\" not found; JAAS config = %s","messagePattern":"Entry \"(.+?)\" not found; JAAS config = (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java","lineNumber":724,"sourceCode":"   * Resolve the context of an entry. This is an effective test of\n   * JAAS setup, because it will relay detected problems up\n   * @param context context name\n   * @return the entry\n   * @throws RuntimeException if there is no context entry found\n   */\n  public static AppConfigurationEntry[] validateContext(String context)  {\n    if (context == null) {\n      throw new RuntimeException(\"Null context argument\");\n    }\n    if (context.isEmpty()) {\n      throw new RuntimeException(\"Empty context argument\");\n    }\n    javax.security.auth.login.Configuration configuration =\n        javax.security.auth.login.Configuration.getConfiguration();\n    AppConfigurationEntry[] entries =\n        configuration.getAppConfigurationEntry(context);\n    if (entries == null) {\n      throw new RuntimeException(\n          String.format(\"Entry \\\"%s\\\" not found; \" +\n                        \"JAAS config = %s\",\n              context,\n              describeProperty(Environment.JAAS_CONF_KEY) ));\n    }\n    return entries;\n  }\n\n  /**\n   * Apply the security environment to this curator instance. This\n   * may include setting up the ZK system properties for SASL\n   * @param builder curator builder\n   * @throws IOException if jaas configuration can't be generated or found\n   */\n  public void applySecurityEnvironment(CuratorFrameworkFactory.Builder\n      builder) throws IOException {\n\n    if (isSecureRegistry()) {","sourceCodeStart":706,"sourceCodeEnd":742,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-registry/src/main/java/org/apache/hadoop/registry/client/impl/zk/RegistrySecurity.java#L706-L742","documentation":"During SASL setup, RegistrySecurity.validateContext(context) looks up the JAAS login context (default 'Client', or the value of hadoop.registry.jaas.context) in the JVM-wide javax.security.auth.login.Configuration. A null lookup — the context is not defined in the loaded JAAS configuration — throws a RuntimeException with both the context name and the current value of the java.security.auth.login.config property, so you can tell whether a JAAS file was loaded at all.","triggerScenarios":"SASL registry access on a JVM launched without -Djava.security.auth.login.config; a JAAS file that defines no entry matching hadoop.registry.jaas.context (case-sensitive); a context-name mismatch between config and file.","commonSituations":"Registry-enabled YARN services missing the standard jaas.conf; JVM options dropped when moving a command line into a service definition or container; JAAS file unreadable so the Configuration falls back with no matching entries.","solutions":["Create a JAAS file whose entry name matches hadoop.registry.jaas.context (default 'Client'), e.g. Client { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab=\"...\" principal=\"...\"; };","Launch the JVM with -Djava.security.auth.login.config=/path/jaas.conf.","Alternatively supply the registry principal and keytab (setKerberosPrincipalAndKeytab) so RegistrySecurity builds an in-memory JaasConfiguration.","Verify the file is readable and the entry name matches exactly, including case."],"exampleFix":"// before: JVM started without a JAAS config -> RuntimeException: Entry \"Client\" not found; JAAS config = (unset)\njava -jar app.jar\n\n// after\njava -Djava.security.auth.login.config=/etc/security/jaas.conf -jar app.jar\n# /etc/security/jaas.conf must contain an entry named like hadoop.registry.jaas.context (default \"Client\"):\nClient {\n  com.sun.security.auth.module.Krb5LoginModule required\n  useKeyTab=true\n  keyTab=\"/etc/security/keytabs/registry.keytab\"\n  principal=\"registry/_HOST@REALM\";\n};","handlingStrategy":"validation","validationCode":"// pre-flight check before creating a SASL registry client\nString context = conf.get(\"hadoop.registry.jaas.context\", \"Client\");\ntry {\n  RegistrySecurity.validateContext(context);\n} catch (RuntimeException e) {\n  throw new IllegalStateException(\n      \"JAAS entry '\" + context + \"' missing; check -Djava.security.auth.login.config=\"\n      + System.getProperty(\"java.security.auth.login.config\"), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  RegistryOperations ops = RegistryOperationsFactory.createKerberosInstance(conf, principal, keytab);\n} catch (RuntimeException e) {\n  if (e.getMessage().contains(\"not found; JAAS config\")) {\n    // add the named entry to the JAAS file (or launch with -Djava.security.auth.login.config) and retry\n  }\n}","preventionTips":["Standardize a jaas.conf per deployment whose entry names match hadoop.registry.jaas.context (default 'Client').","Assert at startup that java.security.auth.login.config is set and the file is readable.","Keep entry names case-consistent between config and JAAS file; validate with RegistrySecurity.validateContext in tests."],"tags":["registry","jaas","sasl","kerberos","zookeeper","configuration","hadoop-registry"],"backgroundTag":"jaas-entry-missing","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}