{"record":{"id":"95f9e57eab506aad","repo":"juicedata/juicefs","slug":"no-kerberos-credential-was-found-parameter-key","errorCode":null,"errorMessage":"No kerberos credential was found! Parameter \"--keytab\" and \"--principal\" must be provided.","messagePattern":"No kerberos credential was found! Parameter \"--keytab\" and \"--principal\" must be provided\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sdk/java/src/main/java/io/juicefs/tools/RangerDownloader.java","lineNumber":50,"sourceCode":"  @Parameter(names = {\"--fs\"}, description = \"JuiceFileSystem: jfs://{JFS_VOL_NAME}\", required = true)\n  private String fs;\n\n  @Parameter(names = {\"--keytab\"}, description = \"local keytab file location\")\n  private String keytab;\n\n  @Parameter(names = {\"--principal\"}, description = \"principal allowed access ranger admin\")\n  private String principal;\n\n  @Override\n  public void init() throws IOException {\n\n  }\n\n  @Override\n  public void run() throws IOException {\n    UserGroupInformation ugi = UserGroupInformation.getCurrentUser();\n    if (!ugi.hasKerberosCredentials() && (keytab == null || principal == null)) {\n      throw new IllegalArgumentException(\"No kerberos credential was found! Parameter \\\"--keytab\\\" and \\\"--principal\\\" must be provided.\");\n    }\n    if (keytab != null) {\n      UserGroupInformation.loginUserFromKeytab(principal, keytab);\n    }\n    Configuration cfg = new Configuration();\n    JuiceFileSystemImpl jfs = new JuiceFileSystemImpl(true);\n    jfs.initialize(URI.create(fs), cfg);\n    new RangerPermissionChecker(jfs, jfs.checkAndGetRangerParams(cfg));\n  }\n\n  @Override\n  public void close() throws IOException {\n\n  }\n\n  @Override\n  public String getCommand() {\n    return \"ranger\";","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/sdk/java/src/main/java/io/juicefs/tools/RangerDownloader.java#L32-L68","documentation":"RangerDownloader.run requires Kerberos credentials to authenticate to Ranger/Hadoop before downloading; if the current UGI has no Kerberos credentials and either --keytab or --principal is missing, it throws this IllegalArgumentException.","triggerScenarios":"Running the RangerDownloader tool (from main) without passing both --keytab and --principal, and without an existing Kerberos login (kinit) in the process.","commonSituations":"Forgetting CLI flags in cron/automation; assuming a kinit'ed TGT exists on service accounts; headless environments with no ticket cache.","solutions":["Pass both --keytab <path> and --principal <user@REALM> to the tool","Run `kinit` (or use a ticket cache) before invoking so UGI has Kerberos credentials","Set HADOOP_KERBEROS settings / ensure core-site.xml default names are correct","Wrap invocation in a script that validates the ticket cache with `klist -s`"],"exampleFix":"// before\njava -cp ... io.juicefs.tools.RangerDownloader\n// after\njava -cp ... io.juicefs.tools.RangerDownloader --keytab /etc/security/keytabs/jfs.keytab --principal jfs@EXAMPLE.COM","handlingStrategy":"validation","validationCode":"UserGroupInformation ugi = UserGroupInformation.getCurrentUser();\nif (!ugi.hasKerberosCredentials() && (keytab == null || principal == null)) {\n  throw new IllegalArgumentException(\"Provide --keytab and --principal or kinit first\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  downloader.run();\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"No kerberos credential was found\")) {\n    LOG.error(\"Run kinit or pass --keytab/--principal\");\n  } else throw e;\n}","preventionTips":["Always pass --keytab and --principal in automation","Validate ticket cache (klist -s) before launching the tool","Use keytab login for headless/service accounts"],"tags":["kerberos","authentication","cli","ranger"],"backgroundTag":"missing-credentials","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}