{"record":{"id":"9ccc4df28d075810","repo":"apache/druid","slug":"keytab-does-not-exist","errorCode":null,"errorMessage":"Keytab does not exist: ","messagePattern":"Keytab does not exist: ","errorType":"exception","errorClass":"ServletException","httpStatus":500,"severity":"critical","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java","lineNumber":508,"sourceCode":"          )\n      };\n    }\n  }\n\n  private void initializeKerberosLogin() throws ServletException\n  {\n    String keytab;\n\n    try {\n      if (serverPrincipal == null || serverPrincipal.trim().length() == 0) {\n        throw new ServletException(\"Principal not defined in configuration\");\n      }\n      keytab = serverKeytab;\n      if (keytab == null || keytab.trim().length() == 0) {\n        throw new ServletException(\"Keytab not defined in configuration\");\n      }\n      if (!new File(keytab).exists()) {\n        throw new ServletException(\"Keytab does not exist: \" + keytab);\n      }\n\n      Set<Principal> principals = new HashSet<>();\n      principals.add(new KerberosPrincipal(serverPrincipal));\n      Subject subject = new Subject(false, principals, new HashSet<>(), new HashSet<>());\n\n      DruidKerberosConfiguration kerberosConfiguration = new DruidKerberosConfiguration(keytab, serverPrincipal);\n\n      log.info(\"Login using keytab \" + keytab + \", for principal \" + serverPrincipal);\n      loginContext = new LoginContext(\"\", subject, null, kerberosConfiguration);\n      loginContext.login();\n\n      log.info(\"Initialized, principal %s from keytab %s\", serverPrincipal, keytab);\n    }\n    catch (Exception ex) {\n      throw new ServletException(ex);\n    }\n  }","sourceCodeStart":490,"sourceCodeEnd":526,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java#L490-L526","documentation":"After principal and keytab-path config checks pass, initializeKerberosLogin verifies the keytab file actually exists on disk. A missing file aborts the JAAS server login with a ServletException carrying the path, thrown during doFilter initialization.","triggerScenarios":"doFilter -> initializeKerberosLogin where serverKeytab is non-blank but new File(serverKeytab).exists() is false on the host being started.","commonSituations":"Keytab deployed only to some cluster nodes; path typo or hostname-specific filename differing per node; container images built without the keytab mounted; keytab deleted by security rotation.","solutions":["Deploy the keytab to the exact configured path on every node (or mount it in containers)","Fix druid.auth.kerberos.serverKeytab to the real path (use _HOST substitution patterns where supported)","Check mount/permissions so the druid process can access the file","Regenerate the keytab with kadmin ktadd if it was lost during rotation"],"exampleFix":"// before\nprops.setProperty(\"druid.auth.kerberos.serverKeytab\", \"/etc/security/keytabs/http.keytab\"); // not present in container\n// after\n// mount keytab and set:\nprops.setProperty(\"druid.auth.kerberos.serverKeytab\", \"/etc/security/keytabs/http_$(hostname -f).keytab\");","handlingStrategy":"validation","validationCode":"String keytab = props.getProperty(\"druid.auth.kerberos.serverKeytab\");\njava.io.File f = new java.io.File(keytab);\nif (!f.exists() || !f.canRead()) {\n  throw new IllegalStateException(\"Keytab missing or unreadable on this host: \" + keytab);\n}","typeGuard":null,"tryCatchPattern":"try {\n  authenticator.init(config);\n} catch (ServletException e) {\n  if (e.getMessage().startsWith(\"Keytab does not exist\")) { log.error(\"Deploy keytab: {}\", e.getMessage()); }\n  throw e;\n}","preventionTips":["Deploy/mount keytabs on every node before service start","Verify keytab presence and readability in node startup health checks","Use _HOST-style paths or per-node templating so paths match reality"],"tags":["kerberos","keytab","file-not-found"],"backgroundTag":"file-not-found","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}