{"record":{"id":"7073fb245945bcf2","repo":"apache/seatunnel","slug":"principal-or-keytabpath-is-empty-it-wil-7073fb","errorCode":null,"errorMessage":"Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication","messagePattern":"Principal \\[(.+?)\\] or keytabPath \\[(.+?)\\] is empty, it will skip kerberos authentication","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-jdbc/src/main/java/org/apache/seatunnel/connectors/seatunnel/jdbc/utils/HiveJdbcUtils.java","lineNumber":45,"sourceCode":"\nimport lombok.extern.slf4j.Slf4j;\n\nimport java.io.IOException;\n\nimport static org.apache.seatunnel.connectors.seatunnel.jdbc.exception.JdbcConnectorErrorCode.KERBEROS_AUTHENTICATION_FAILED;\n\n@Slf4j\npublic class HiveJdbcUtils {\n\n    public static synchronized void doKerberosAuthentication(JdbcConnectionConfig jdbcConfig) {\n        String principal = jdbcConfig.getKerberosPrincipal();\n        String keytabPath = jdbcConfig.getKerberosKeytabPath();\n        String krb5Path = jdbcConfig.getKrb5Path();\n        System.setProperty(\"java.security.krb5.conf\", krb5Path);\n        Configuration configuration = new Configuration();\n\n        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {\n            log.warn(\n                    \"Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication\",\n                    principal,\n                    keytabPath);\n        } else {\n            configuration.set(\"hadoop.security.authentication\", \"kerberos\");\n            UserGroupInformation.setConfiguration(configuration);\n            try {\n                log.info(\n                        \"Start Kerberos authentication using principal {} and keytab {}\",\n                        principal,\n                        keytabPath);\n                UserGroupInformation.loginUserFromKeytab(principal, keytabPath);\n                log.info(\"Kerberos authentication successful\");\n            } catch (IOException e) {\n                String errorMsg =\n                        String.format(\n                                \"Kerberos authentication failed using this \"\n                                        + \"principal [%s] and keytab path [%s]\",","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-jdbc/src/main/java/org/apache/seatunnel/connectors/seatunnel/jdbc/utils/HiveJdbcUtils.java#L27-L63","documentation":"HiveJdbcUtils.doKerberosAuthentication sets the krb5 conf system property, then checks whether principal or keytabPath is blank. If either is empty, Kerberos login is skipped with this warning; otherwise Hadoop UGI is configured for kerberos and loginUserFromKeytab is performed.","triggerScenarios":"doKerberosAuthentication is called with a JdbcConnectionConfig where kerberos_principal or kerberos_keytab_path is null/empty/whitespace while some kerberos-related settings (e.g. krb5 path) are present.","commonSituations":"Users enable kerberos partially (set krb5.conf but forget principal or keytab path); auth.type=kerberos misconfig; copied config template without filling in credential fields.","solutions":["Set both kerberos_principal and kerberos_keytab_path in the JDBC connection config to enable Kerberos auth.","Verify the keytab file exists and is readable by the SeaTunnel process.","If Kerberos is not required, this warning is safe to ignore (connection proceeds without Kerberos).","Check for typos/extra whitespace in the config values (isBlank treats whitespace-only as empty)."],"exampleFix":"// before\nurl = \"jdbc:hive2://host:10000/db;principal=hive/_HOST@REALM\"\n# kerberos_keytab_path not set\n// after\nurl = \"jdbc:hive2://host:10000/db\"\nauth.type = \"kerberos\"\nkerberos_principal = \"user@REALM\"\nkerberos_keytab_path = \"/etc/security/keytabs/user.keytab\"\nkrb5_path = \"/etc/krb5.conf\"","handlingStrategy":"validation","validationCode":"if (isBlank(principal) || isBlank(keytabPath)) {\n    throw new IllegalArgumentException(\"kerberos_principal and kerberos_keytab_path must both be set for Kerberos auth\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fill in all kerberos fields when auth.type=kerberos","Check keytab file existence and readability","Avoid whitespace-only values in credentials config"],"tags":["jdbc","kerberos","authentication","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}