{"record":{"id":"9dca538340eb229b","repo":"apache/seatunnel","slug":"kerberos-authentication-is-not-configured-it-will","errorCode":null,"errorMessage":"Kerberos authentication is not configured, it will skip kerberos authentication","messagePattern":"Kerberos authentication is not configured, it will skip kerberos authentication","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java","lineNumber":150,"sourceCode":"    private Configuration doKerberosLogin(Configuration configuration) {\n        String kerberosKrb5ConfPath = config.getKerberosKrb5ConfPath();\n        String kerberosKeytabPath = config.getKerberosKeytabPath();\n        String kerberosPrincipal = config.getKerberosPrincipal();\n\n        if (StringUtils.isNotEmpty(kerberosPrincipal)\n                && StringUtils.isNotEmpty(kerberosKrb5ConfPath)\n                && StringUtils.isNotEmpty(kerberosKeytabPath)) {\n            try {\n                System.setProperty(\"java.security.krb5.conf\", kerberosKrb5ConfPath);\n                System.setProperty(\"krb.principal\", kerberosPrincipal);\n                doKerberosAuthentication(configuration, kerberosPrincipal, kerberosKeytabPath);\n            } catch (Exception e) {\n                throw new IcebergConnectorException(\n                        CommonErrorCode.KERBEROS_AUTHORIZED_FAILED,\n                        String.format(\"Kerberos authentication failed: %s\", e.getMessage()));\n            }\n        } else {\n            log.warn(\n                    \"Kerberos authentication is not configured, it will skip kerberos authentication\");\n        }\n\n        return configuration;\n    }\n\n    public static void doKerberosAuthentication(\n            Configuration configuration, String principal, String keytabPath) {\n        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {\n            log.warn(\n                    \"Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication\",\n                    principal,\n                    keytabPath);\n        } else {\n            configuration.set(\"hadoop.security.authentication\", \"kerberos\");\n            UserGroupInformation.setConfiguration(configuration);\n            try {\n                log.info(","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java#L132-L168","documentation":"This warning is logged by IcebergCatalogLoader.doKerberosLogin() when the Kerberos configuration is not present, so Kerberos authentication is skipped entirely and the job continues with a non-secure Hadoop configuration. It is informational for unsecured clusters, but a red flag if your HDFS/Hive catalog actually requires Kerberos — subsequent file access will then fail with permission or authentication errors.","triggerScenarios":"doKerberosLogin() is invoked during loadCatalog(); the check that gates kerberos login (krb5/principal/keytab options enabled) evaluates false, taking the else branch that logs this warning and returns the configuration unchanged.","commonSituations":"Forgetting to set kerberos options (principal/keytab/krb5 path) on a secured cluster; running locally where the secure options were omitted; clusters without Kerberos where the warning is expected and harmless.","solutions":["If your cluster is secured, configure the Kerberos options (principal, keytab path, krb5 conf) on the Iceberg sink/catalog and rerun.","If the cluster is unsecured, ignore this warning — it confirms Kerberos was intentionally skipped.","If auth was expected via another mechanism (e.g. keytab auto-detected), verify the option names and values match the connector's documented keys."],"exampleFix":"// before\nsink {\n  Iceberg {\n    catalog_name = \"hive\"\n  }\n}\n// after\nsink {\n  Iceberg {\n    catalog_name = \"hive\"\n    kerberos_principal = \"user@EXAMPLE.COM\"\n    kerberos_keytab_path = \"/etc/security/keytabs/user.keytab\"\n    krb5_path = \"/etc/krb5.conf\"\n  }\n}","handlingStrategy":"validation","validationCode":"if (isSecuredCluster && (principal == null || keytabPath == null || krb5Path == null)) {\n    throw new IllegalArgumentException(\"Kerberos options required for secured cluster: principal, keytabPath, krb5Path\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["On secured clusters always configure principal, keytab and krb5 path before launch","Verify with a kinit test that the principal/keytab are valid","Expect this warning on unsecured clusters and treat it as confirmation, not a problem"],"tags":["kerberos","iceberg","authentication","security"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}