{"record":{"id":"7dbc06f232a96399","repo":"apache/hadoop","slug":"server-has-invalid-kerberos-principal-s-doesn-t","errorCode":null,"errorMessage":"Server has invalid Kerberos principal: %s, doesn't match the pattern: %s","messagePattern":"Server has invalid Kerberos principal: (.+?), doesn't match the pattern: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":327,"sourceCode":"      return null;\n    }\n    String serverKey = krbInfo.serverPrincipal();\n    if (serverKey == null) {\n      throw new IllegalArgumentException(\n          \"Can't obtain server Kerberos config key from protocol=\"\n              + protocol.getCanonicalName());\n    }\n    // construct server advertised principal for comparision\n    String serverPrincipal = new KerberosPrincipal(\n        authType.getProtocol() + \"/\" + authType.getServerId(),\n        KerberosPrincipal.KRB_NT_SRV_HST).getName();\n\n    // use the pattern if defined\n    String serverKeyPattern = conf.get(serverKey + \".pattern\");\n    if (serverKeyPattern != null && !serverKeyPattern.isEmpty()) {\n      Pattern pattern = GlobPattern.compile(serverKeyPattern);\n      if (!pattern.matcher(serverPrincipal).matches()) {\n        throw new IllegalArgumentException(String.format(\n            \"Server has invalid Kerberos principal: %s,\"\n                + \" doesn't match the pattern: %s\",\n            serverPrincipal, serverKeyPattern));\n      }\n    } else {\n      // check that the server advertised principal matches our conf\n      String confPrincipal = SecurityUtil.getServerPrincipal(\n          conf.get(serverKey), serverAddr.getAddress());\n      if (LOG.isDebugEnabled()) {\n        LOG.debug(\"getting serverKey: \" + serverKey + \" conf value: \" + conf.get(serverKey)\n            + \" principal: \" + confPrincipal);\n      }\n      if (confPrincipal == null || confPrincipal.isEmpty()) {\n        throw new IllegalArgumentException(\n            \"Failed to specify server's Kerberos principal name\");\n      }\n      KerberosName name = new KerberosName(confPrincipal);\n      if (name.getHostName() == null) {","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L309-L345","documentation":"Error \"Server has invalid Kerberos principal: %s, doesn't match the pattern: %s\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:327 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Correct the server's Kerberos principal so it matches the required pattern service/hostname@REALM with a valid hostname component.","Fix DNS resolution of the server host so the principal hostname matches.","Update the service configuration to use the correct principal from the keytab."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}