{"record":{"id":"92350e5de146c135","repo":"apache/hadoop","slug":"running-in-secure-mode-but-config-doesn-t-have-a","errorCode":null,"errorMessage":"Running in secure mode, but config doesn't have a keytab for key: ","messagePattern":"Running in secure mode, but config doesn't have a keytab for key: ","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java","lineNumber":328,"sourceCode":"   *          the key to look for keytab file in conf\n   * @param userNameKey\n   *          the key to look for user's Kerberos principal name in conf\n   * @param hostname\n   *          hostname to use for substitution\n   * @throws IOException if the config doesn't specify a keytab\n   */\n  @InterfaceAudience.Public\n  @InterfaceStability.Evolving\n  public static void login(final Configuration conf,\n      final String keytabFileKey, final String userNameKey, String hostname)\n      throws IOException {\n    \n    if(! UserGroupInformation.isSecurityEnabled()) \n      return;\n    \n    String keytabFilename = conf.get(keytabFileKey);\n    if (keytabFilename == null || keytabFilename.length() == 0) {\n      throw new IOException(\n          \"Running in secure mode, but config doesn't have a keytab for key: \" + keytabFileKey);\n    }\n\n    String principalConfig = conf.get(userNameKey, System\n        .getProperty(\"user.name\"));\n    String principalName = SecurityUtil.getServerPrincipal(principalConfig,\n        hostname);\n    UserGroupInformation.loginUserFromKeytab(principalName, keytabFilename);\n  }\n\n  /**\n   * create the service name for a Delegation token\n   * @param uri of the service\n   * @param defPort is used if the uri lacks a port\n   * @return the token service, or null if no authority\n   * @see #buildTokenService(InetSocketAddress)\n   */\n  public static String buildDTServiceName(URI uri, int defPort) {","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SecurityUtil.java#L310-L346","documentation":"SecurityUtil.login(conf, keytabFileKey, userNameKey, hostname) performs keytab login for daemons. When Kerberos is enabled (UserGroupInformation.isSecurityEnabled) but conf.get(keytabFileKey) is null or empty, it throws IOException naming the missing config key (e.g. dfs.namenode.keytab.file) so the operator knows exactly which property to set.","triggerScenarios":"hadoop.security.authentication=kerberos while the daemon keytab property (dfs.namenode.keytab.file, mapreduce.jobhistory.keytab.file, etc.) is unset, empty, or misspelled, and the daemon calls SecurityUtil.login at startup.","commonSituations":"Enabling security on an existing cluster but forgetting daemon keytab configs; XML property-name typos; an empty value overriding a valid one later in the config chain.","solutions":["Set the keytab property named in the message to the path of the daemon's keytab file","Set the matching principal property (userNameKey, e.g. dfs.namenode.kerberos.principal) as well","Confirm the file exists and is readable by the daemon user: klist -kt <path>","Redeploy identical configs to all nodes and restart the daemon"],"exampleFix":"<!-- before -->\n<property><name>dfs.namenode.keytab.file</name><value></value></property>\n\n<!-- after -->\n<property><name>dfs.namenode.keytab.file</name><value>/etc/security/keytab/nn.service.keytab</value></property>","handlingStrategy":"validation","validationCode":"String keytab = conf.get(keytabFileKey);\nif (UserGroupInformation.isSecurityEnabled()\n    && (keytab == null || keytab.isEmpty())) {\n  throw new IOException(\"Missing required keytab config: \" + keytabFileKey\n      + \" while Kerberos is enabled\");\n}\nSecurityUtil.login(conf, keytabFileKey, userNameKey, hostname);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail fast at startup: check every keytab property when hadoop.security.authentication=kerberos","Verify keytab files exist and are readable by the daemon user before restart","Keep principal and keytab properties adjacent in config templates so they are set together"],"tags":["kerberos","keytab","configuration","startup"],"backgroundTag":"missing-keytab-config","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}