{"record":{"id":"6ea5197ef5dc03b5","repo":"apache/druid","slug":"failed-to-authenticate-user-principal-s-with-ke","errorCode":null,"errorMessage":"Failed to authenticate user principal [%s] with keytab [%s]","messagePattern":"Failed to authenticate user principal \\[(.+?)\\] with keytab \\[(.+?)\\]","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/druid-iceberg-extensions/src/main/java/org/apache/druid/iceberg/input/HiveIcebergCatalog.java","lineNumber":124,"sourceCode":"    return catalog;\n  }\n\n  private void authenticate()\n  {\n    String principal = catalogProperties.getOrDefault(\"principal\", null);\n    String keytab = catalogProperties.getOrDefault(\"keytab\", null);\n    if (!Strings.isNullOrEmpty(principal) && !Strings.isNullOrEmpty(keytab)) {\n      UserGroupInformation.setConfiguration(configuration);\n      if (UserGroupInformation.isSecurityEnabled()) {\n        try {\n          if (UserGroupInformation.getCurrentUser().hasKerberosCredentials() == false\n              || !UserGroupInformation.getCurrentUser().getUserName().equals(principal)) {\n            log.info(\"Hive trying to authenticate user [%s] with keytab [%s]..\", principal, keytab);\n            UserGroupInformation.loginUserFromKeytab(principal, keytab);\n          }\n        }\n        catch (IOException e) {\n          throw new ISE(e, \"Failed to authenticate user principal [%s] with keytab [%s]\", principal, keytab);\n        }\n      }\n    }\n  }\n\n  public String getWarehousePath()\n  {\n    return warehousePath;\n  }\n\n  public String getCatalogUri()\n  {\n    return catalogUri;\n  }\n\n  public Map<String, String> getCatalogProperties()\n  {\n    return catalogProperties;","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/druid-iceberg-extensions/src/main/java/org/apache/druid/iceberg/input/HiveIcebergCatalog.java#L106-L142","documentation":"Kerberos authentication failure in HiveIcebergCatalog.authenticate(): when Hadoop security is enabled and a principal/keytab pair is configured, the UserGroupInformation login for that principal from the given keytab failed (wrong principal/keytab pair, missing or unreadable keytab file, or KDC rejection). The catalog cannot access Hive Metastore-backed iceberg tables without valid credentials.","triggerScenarios":"Thrown at extensions-contrib/druid-iceberg-extensions/src/main/java/org/apache/druid/iceberg/input/HiveIcebergCatalog.java:124 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the principal exists in the KDC and matches the keytab entries (klist -kt).","Check the keytab file path, its readability by the Druid process, and krb5.conf/realm settings."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}