{"record":{"id":"743d592e0bc4fcfb","repo":"apache/hadoop","slug":"principals-do-not-exist-in-the-keytab","errorCode":null,"errorMessage":"Principals do not exist in the keytab","messagePattern":"Principals do not exist in the keytab","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java","lineNumber":166,"sourceCode":"        throw new ServletException(\"Principal not defined in configuration\");\n      }\n      keytab = config.getProperty(KEYTAB, keytab);\n      if (keytab == null || keytab.trim().length() == 0) {\n        throw new ServletException(\"Keytab not defined in configuration\");\n      }\n      File keytabFile = new File(keytab);\n      if (!keytabFile.exists()) {\n        throw new ServletException(\"Keytab does not exist: \" + keytab);\n      }\n      \n      // use all SPNEGO principals in the keytab if a principal isn't\n      // specifically configured\n      final String[] spnegoPrincipals;\n      if (principal.equals(\"*\")) {\n        spnegoPrincipals = KerberosUtil.getPrincipalNames(\n            keytab, Pattern.compile(\"HTTP/.*\"));\n        if (spnegoPrincipals.length == 0) {\n          throw new ServletException(\"Principals do not exist in the keytab\");\n        }\n      } else {\n        spnegoPrincipals = new String[]{principal};\n      }\n      KeyTab keytabInstance = KeyTab.getInstance(keytabFile);\n      serverSubject.getPrivateCredentials().add(keytabInstance);\n      for (String spnegoPrincipal : spnegoPrincipals) {\n        Principal krbPrincipal = new KerberosPrincipal(spnegoPrincipal);\n        LOG.info(\"Using keytab {}, for principal {}\",\n            keytab, krbPrincipal);\n        serverSubject.getPrincipals().add(krbPrincipal);\n      }\n      String nameRules = config.getProperty(NAME_RULES, null);\n      if (nameRules != null) {\n        KerberosName.setRules(nameRules);\n      }\n      String ruleMechanism = config.getProperty(RULE_MECHANISM, null);\n      if (ruleMechanism != null) {","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java#L148-L184","documentation":"Error \"Principals do not exist in the keytab\" thrown in apache/hadoop.","triggerScenarios":"Raised at runtime when the documented precondition or configuration requirement for this operation is violated.","commonSituations":"Misconfigured or missing property, invalid user input, or calling the API before its prerequisites are met.","solutions":["Add the configured service principal to the keytab so at least one principal exists in it."],"exampleFix":"ktutil: addent / rkv the principal into the keytab.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}