{"record":{"id":"9661951a684f2817","repo":"apache/seatunnel","slug":"check-connectivity-failed","errorCode":null,"errorMessage":"check connectivity failed, ","messagePattern":"check connectivity failed, ","errorType":"exception","errorClass":"SeaTunnelException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java","lineNumber":176,"sourceCode":"            Configuration configuration, String principal, String keytabPath) {\n        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {\n            log.warn(\n                    \"Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication\",\n                    principal,\n                    keytabPath);\n        } else {\n            configuration.set(\"hadoop.security.authentication\", \"kerberos\");\n            UserGroupInformation.setConfiguration(configuration);\n            try {\n                log.info(\n                        \"Start Kerberos authentication using principal {} and keytab {}\",\n                        principal,\n                        keytabPath);\n                UserGroupInformation.loginUserFromKeytab(principal, keytabPath);\n                UserGroupInformation loginUser = UserGroupInformation.getLoginUser();\n                log.info(\"Kerberos authentication successful,UGI {}\", loginUser);\n            } catch (IOException e) {\n                throw new SeaTunnelException(\"check connectivity failed, \" + e.getMessage(), e);\n            }\n        }\n    }\n}\n","sourceCodeStart":158,"sourceCodeEnd":181,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java#L158-L181","documentation":"doKerberosAuthentication calls UserGroupInformation.loginUserFromKeytab; any IOException from that low-level login (file IO, Kerberos protocol failures) is rethrown as a plain SeaTunnelException with the message prefix 'check connectivity failed, '. It is the raw底层 failure that error 1623 usually wraps.","triggerScenarios":"doKerberosLogin (with kerberos principal+keytab configured) invokes this public method and UserGroupInformation.loginUserFromKeytab throws IOException — e.g. keytab file missing/unreadable, KDC unreachable, principal not in keytab.","commonSituations":"Keytab not distributed to worker nodes; KDC hostname wrong or firewalled (connection timeouts); krb5.conf absent so default realm cannot be resolved; expired or corrupted keytab.","solutions":["Read the suffix after 'check connectivity failed, ' for the real IOException cause and fix it (file path, KDC reachability, realm)","Confirm the keytab file exists and is readable by the SeaTunnel worker process user on each node","Verify KDC connectivity from workers: kinit -kt <keytab> <principal> or nc/ telnet to the KDC port from the same host","Set java.security.krb5.conf correctly and ensure the principal exactly matches an entry in the keytab"],"exampleFix":"// fix usually on the environment, not code:\n// before: keytab only on driver node\n// after: scp /etc/security/keytabs/user.keytab to all worker nodes and chmod 400 + chown seauser","handlingStrategy":"try-catch","validationCode":"File keytab = new File(keytabPath);\nif (!keytab.canRead()) throw new IllegalStateException(\"Keytab unreadable: \" + keytabPath);\nUserGroupInformation.setConfiguration(conf);\n// Optionally dry-run: UserGroupInformation.loginUserFromKeytabAndReturnUGI(principal, keytabPath);","typeGuard":null,"tryCatchPattern":"try {\n  doKerberosAuthentication(conf, principal, keytabPath);\n} catch (SeaTunnelException e) {\n  // e.getCause() is the original IOException — inspect it for file/KDC issues\n  log.error(\"Kerberos login failed: {}\", e.getCause(), e);\n}","preventionTips":["Run kinit -kt as the job user as a pre-flight on each worker","Check KDC reachability/firewall from worker hosts","Confirm the keytab contains the exact principal (klist -kt)","Set java.security.krb5.conf before any UGI call"],"tags":["iceberg","kerberos","hadoop","authentication"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}