{"record":{"id":"94160e11f2c30cbc","repo":"apache/hadoop","slug":"bad-kerberos-server-principal-configuration","errorCode":null,"errorMessage":"Bad Kerberos server principal configuration","messagePattern":"Bad Kerberos server principal configuration","errorType":"exception","errorClass":"SaslException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":247,"sourceCode":"              \" or user doesn't have one\");\n          return null;\n        }\n        saslCallback = new SaslClientCallbackHandler(token);\n        break;\n      }\n      case KERBEROS: {\n        if (ugi.getRealAuthenticationMethod().getAuthMethod() !=\n            AuthMethod.KERBEROS) {\n          LOG.debug(\"client isn't using kerberos\");\n          return null;\n        }\n        final String serverPrincipal;\n        try {\n          serverPrincipal = getServerPrincipal(authType);\n        } catch (IllegalArgumentException ex) {\n          // YARN-11210: getServerPrincipal can throw IllegalArgumentException if Kerberos\n          // configuration is bad, this is surfaced as a non-retryable SaslException\n          throw new SaslException(\"Bad Kerberos server principal configuration\", ex);\n        }\n        if (serverPrincipal == null) {\n          LOG.debug(\"protocol doesn't use kerberos\");\n          return null;\n        }\n        if (LOG.isDebugEnabled()) {\n          LOG.debug(\"RPC Server's Kerberos principal name for protocol=\"\n              + protocol.getCanonicalName() + \" is \" + serverPrincipal);\n        }\n        break;\n      }\n      default:\n        throw new IOException(\"Unknown authentication method \" + method);\n    }\n\n    String mechanism = method.getMechanismName();\n    if (LOG.isDebugEnabled()) {\n      LOG.debug(\"Creating SASL \" + mechanism + \"(\" + method + \") \"","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L229-L265","documentation":"Error \"Bad Kerberos server principal configuration\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:247 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Correct the server Kerberos principal configuration for the protocol; the principal must include the server hostname (or _HOST resolvable) and a valid realm.","Verify the keytab referenced contains the configured principal.","Check DNS/reverse-DNS so the hostname used in the principal resolves correctly."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}