{"record":{"id":"a0e63898ed584db2","repo":"apache/druid","slug":"keytab-not-defined-in-configuration","errorCode":null,"errorMessage":"Keytab not defined in configuration","messagePattern":"Keytab not defined in configuration","errorType":"exception","errorClass":"ServletException","httpStatus":null,"severity":"critical","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java","lineNumber":84,"sourceCode":"      }\n      catch (LoginException ex) {\n        log.warn(ex, ex.getMessage());\n      }\n    }\n    loginContexts.clear();\n  }\n\n  @Override\n  public void init(Properties config) throws ServletException\n  {\n    try {\n      String principal = config.getProperty(PRINCIPAL);\n      if (principal == null || principal.trim().length() == 0) {\n        throw new ServletException(\"Principal not defined in configuration\");\n      }\n      keytab = config.getProperty(KEYTAB, keytab);\n      if (keytab == null || keytab.trim().length() == 0) {\n        throw new ServletException(\"Keytab not defined in configuration\");\n      }\n      if (!new File(keytab).exists()) {\n        throw new ServletException(\"Keytab does not exist: \" + keytab);\n      }\n\n      // use all SPNEGO principals in the keytab if a principal isn't\n      // specifically configured\n      final String[] spnegoPrincipals;\n      if (\"*\".equals(principal)) {\n        spnegoPrincipals = KerberosUtil.getPrincipalNames(keytab, Pattern.compile(\"HTTP/.*\"));\n        if (spnegoPrincipals.length == 0) {\n          throw new ServletException(\"Principals do not exist in the keytab\");\n        }\n      } else {\n        spnegoPrincipals = new String[]{principal};\n      }\n\n      String nameRules = config.getProperty(NAME_RULES, null);","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java#L66-L102","documentation":"During init of the Kerberos authentication handler, the configured keytab path (druid.auth.kerberos.serverKeytab or the KEYTAB config property) is missing or blank, so SPNEGO login cannot be performed. The handler throws a ServletException to abort startup because Kerberos server authentication is impossible without a keytab.","triggerScenarios":"Calling DruidKerberosAuthenticationHandler.init(Properties) where config.getProperty(KEYTAB) returns null or a whitespace-only string and no default keytab field was set.","commonSituations":"Kerberos extension enabled but druid.auth.kerberos.serverKeytab not set in runtime.properties; property typo (serverKeytab vs keytab); config loader stripped the value; deploying with copied config missing the kerberos block.","solutions":["Set druid.auth.kerberos.serverKeytab to the absolute path of a valid keytab file in the config Properties before init","Verify the config source actually loads the kerberos properties (correct runtime.properties / startup command)","If the keytab path is provisioned externally, confirm the provisioning step ran before service start"],"exampleFix":"// before\nconfig = new Properties(); // missing KEYTAB\nhandler.init(config);\n// after\nconfig.setProperty(\"druid.auth.kerberos.serverKeytab\", \"/etc/security/keytabs/http.service.keytab\");\nhandler.init(config);","handlingStrategy":"validation","validationCode":"String keytab = props.getProperty(\"druid.auth.kerberos.serverKeytab\");\nif (keytab == null || keytab.trim().isEmpty()) {\n  throw new IllegalStateException(\"druid.auth.kerberos.serverKeytab must be set before handler init\");\n}","typeGuard":null,"tryCatchPattern":"try { handler.init(config); } catch (ServletException e) { if (e.getMessage().contains(\"Keytab not defined\")) { log.error(\"Missing keytab config\"); } throw e; }","preventionTips":["Validate all required kerberos properties at config-load time before starting handlers","Use a config template/checklist for kerberos-enabled deployments","Fail fast in CI with a config lint that checks kerberos properties"],"tags":["kerberos","configuration","startup"],"backgroundTag":"missing-required-config-field","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}