{"record":{"id":"99261c5192d9cad0","repo":"apache/druid","slug":"principal-not-defined-in-configuration-99261c","errorCode":null,"errorMessage":"Principal not defined in configuration","messagePattern":"Principal not defined in configuration","errorType":"exception","errorClass":"ServletException","httpStatus":500,"severity":"critical","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java","lineNumber":501,"sourceCode":"      }\n\n      return new AppConfigurationEntry[]{\n          new AppConfigurationEntry(\n              KerberosUtil.getKrb5LoginModuleName(),\n              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,\n              options\n          )\n      };\n    }\n  }\n\n  private void initializeKerberosLogin() throws ServletException\n  {\n    String keytab;\n\n    try {\n      if (serverPrincipal == null || serverPrincipal.trim().length() == 0) {\n        throw new ServletException(\"Principal not defined in configuration\");\n      }\n      keytab = serverKeytab;\n      if (keytab == null || keytab.trim().length() == 0) {\n        throw new ServletException(\"Keytab not defined in configuration\");\n      }\n      if (!new File(keytab).exists()) {\n        throw new ServletException(\"Keytab does not exist: \" + keytab);\n      }\n\n      Set<Principal> principals = new HashSet<>();\n      principals.add(new KerberosPrincipal(serverPrincipal));\n      Subject subject = new Subject(false, principals, new HashSet<>(), new HashSet<>());\n\n      DruidKerberosConfiguration kerberosConfiguration = new DruidKerberosConfiguration(keytab, serverPrincipal);\n\n      log.info(\"Login using keytab \" + keytab + \", for principal \" + serverPrincipal);\n      loginContext = new LoginContext(\"\", subject, null, kerberosConfiguration);\n      loginContext.login();","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java#L483-L519","documentation":"KerberosAuthenticator.initializeKerberosLogin validates that a server principal is configured before performing a JAAS login. A null/blank serverPrincipal (druid.auth.kerberos.serverPrincipal) makes SPNEGO login impossible, so it throws ServletException during filter init via doFilter.","triggerScenarios":"doFilter -> initializeKerberosLogin with serverPrincipal == null or whitespace, i.e. druid.auth.kerberos.serverPrincipal absent from the authenticator config.","commonSituations":"Kerberos authenticator added to the auth chain but its principal property omitted; typo in property name; config JSON for the authenticator missing the field.","solutions":["Set druid.auth.kerberos.serverPrincipal (e.g. HTTP/_HOST@REALM) in the authenticator config","Confirm the authenticator JSON spec includes the kerberos properties block","Restart the service so the filter re-initializes with the corrected config"],"exampleFix":"// before\n\"druid.auth.authenticators\": [\"kerberos\"] // no principal configured\n// after\nprops.setProperty(\"druid.auth.kerberos.serverPrincipal\", \"HTTP/_HOST@EXAMPLE.COM\");","handlingStrategy":"validation","validationCode":"String principal = props.getProperty(\"druid.auth.kerberos.serverPrincipal\");\nif (principal == null || principal.trim().isEmpty()) {\n  throw new IllegalStateException(\"druid.auth.kerberos.serverPrincipal must be set\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  authenticator.init(config);\n} catch (ServletException e) {\n  if (e.getMessage().contains(\"Principal not defined\")) { log.error(\"serverPrincipal missing in kerberos config\"); }\n  throw e;\n}","preventionTips":["Validate kerberos config keys at deployment time (config lint)","Use a shared, reviewed kerberos config snippet across services","Document required kerberos properties in the deployment runbook"],"tags":["kerberos","configuration","spnego"],"backgroundTag":"missing-required-config-field","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}