{"record":{"id":"9f8b15434f38e8d4","repo":"apache/druid","slug":"keytab-does-not-exist-s","errorCode":null,"errorMessage":"Keytab does not exist: %s","messagePattern":"Keytab does not exist: (.+?)","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"critical","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java","lineNumber":87,"sourceCode":"      }\n    }\n    loginContexts.clear();\n  }\n\n  @Override\n  public void init(Properties config) throws ServletException\n  {\n    try {\n      String principal = config.getProperty(PRINCIPAL);\n      if (principal == null || principal.trim().length() == 0) {\n        throw new ServletException(\"Principal not defined in configuration\");\n      }\n      keytab = config.getProperty(KEYTAB, keytab);\n      if (keytab == null || keytab.trim().length() == 0) {\n        throw new ServletException(\"Keytab not defined in configuration\");\n      }\n      if (!new File(keytab).exists()) {\n        throw new ServletException(\"Keytab does not exist: \" + keytab);\n      }\n\n      // use all SPNEGO principals in the keytab if a principal isn't\n      // specifically configured\n      final String[] spnegoPrincipals;\n      if (\"*\".equals(principal)) {\n        spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile(\"HTTP/.*\"));\n        if (spnegoPrincipals.length == 0) {\n          throw new ServletException(\"Principals do not exist in the keytab\");\n        }\n      } else {\n        spnegoPrincipals = new String[]{principal};\n      }\n\n      String nameRules = config.getProperty(NAME_RULES, null);\n      if (nameRules != null) {\n        KerberosName.setRules(nameRules);\n      }","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java#L69-L105","documentation":"init() checks that the configured keytab file exists on local disk after confirming it is non-blank. If new File(keytab).exists() is false, a ServletException is thrown with the path embedded in the message, aborting handler initialization.","triggerScenarios":"init(Properties) invoked with a non-empty KEYTAB value that points to a non-existent file path on the broker/router host.","commonSituations":"Keytab deployed only on some nodes of the cluster; path typo or wrong hostname in keytab file; SELinux/permissions causing the path to be unreadable; keytab regenerated with a different filename after an upgrade.","solutions":["Create/deploy the keytab at the exact configured path on every host running the service","Correct the druid.auth.kerberos.serverKeytab value to the actual keytab path","Check filesystem permissions/SELinux so the druid process can stat the file","Regenerate the keytab with kadmin: ktadd -k /path/http.keytab HTTP/host@REALM if it was deleted"],"exampleFix":"// before\nprops.setProperty(\"druid.auth.kerberos.serverKeytab\", \"/etc/security/keytabs/http_old.keytab\");\n// after\nprops.setProperty(\"druid.auth.kerberos.serverKeytab\", \"/etc/security/keytabs/http_broker1.keytab\");","handlingStrategy":"validation","validationCode":"String keytab = props.getProperty(\"druid.auth.kerberos.serverKeytab\");\nif (keytab == null || !new java.io.File(keytab.trim()).exists()) {\n  throw new IllegalStateException(\"Keytab file not found on this host: \" + keytab);\n}","typeGuard":null,"tryCatchPattern":"try { handler.init(config); } catch (ServletException e) { if (e.getMessage().startsWith(\"Keytab does not exist\")) { log.error(\"Deploy keytab at: {}\", e.getMessage()); } throw e; }","preventionTips":["Deploy keytabs to identical absolute paths on all cluster nodes","Include keytab presence checks in node startup/health scripts","Bake or mount keytabs in container images before service start"],"tags":["kerberos","keytab","file-not-found"],"backgroundTag":"file-not-found","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}