{"record":{"id":"a23d5f42acf1284c","repo":"apache/pulsar","slug":"logincontext-name-jaas-file-section-header-was-n","errorCode":null,"errorMessage":"loginContext name (JAAS file section header) was null. Please check your java.security.login.auth.config (=java.security.login.auth.config) for section header: loginContextName","messagePattern":"loginContext name \\(JAAS file section header\\) was null\\. Please check your java\\.security\\.login\\.auth\\.config \\(=java\\.security\\.login\\.auth\\.config\\) for section header: loginContextName","errorType":"exception","errorClass":"LoginException","httpStatus":null,"severity":"critical","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/sasl/JAASCredentialsContainer.java","lineNumber":67,"sourceCode":"    private LoginContext loginContext;\n    private Map<String, String> configuration;\n\n    public JAASCredentialsContainer(String loginContextName,\n                                    CallbackHandler callbackHandler,\n                                    Map<String, String> configuration)\n        throws LoginException {\n        this.configuration = configuration;\n        this.callbackHandler = callbackHandler;\n        this.loginContextName = loginContextName;\n        AppConfigurationEntry[] entries = Configuration.getConfiguration()\n            .getAppConfigurationEntry(loginContextName);\n        if (entries == null) {\n            final String errorMessage = \"loginContext name (JAAS file section header) was null. \"\n                + \"Please check your java.security.login.auth.config (=\"\n                + System.getProperty(\"java.security.login.auth.config\")\n                + \") for section header: \" + this.loginContextName;\n            log.error().attr(\"details\", errorMessage).log(\"No JAAS Configuration section header found for Client\");\n            throw new LoginException(errorMessage);\n        }\n        LoginContext loginContext = new LoginContext(loginContextName, callbackHandler);\n        loginContext.login();\n        log.info(\"successfully logged in.\");\n\n        this.loginContext = loginContext;\n        this.subject = loginContext.getSubject();\n        this.isKrbTicket = !this.subject.getPrivateCredentials(KerberosTicket.class).isEmpty();\n        if (isKrbTicket) {\n            this.isUsingTicketCache = SaslConstants.isUsingTicketCache(loginContextName);\n            this.principal = SaslConstants.getPrincipal(loginContextName);\n            this.ticketRefreshThread = new TGTRefreshThread(this);\n        } else {\n            throw new LoginException(\"Kerberos authentication without KerberosTicket provided!\");\n        }\n\n        ticketRefreshThread.start();\n    }","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/sasl/JAASCredentialsContainer.java#L49-L85","documentation":"JAASCredentialsContainer's constructor performs a JAAS LoginContext login. When Configuration.getApplicationConfiguration returns null for the configured loginContextName, there is no matching section header in the JAAS config file, so it logs the error and throws LoginException. The library cannot authenticate without a JAAS entry.","triggerScenarios":"Constructing JAASCredentialsContainer with a loginContextName (e.g. 'KafkaClient', 'PulsarClient') that has no corresponding section in the file pointed to by java.security.login.auth.config, or when that system property/file is missing entirely.","commonSituations":"Kerberos SASL setup where -Djava.security.auth.login.config points to a missing/typo'd JAAS file; JAAS file lacks the expected section name; property name confusion (the message references java.security.login.auth.config); deploying without the keytab/JAAS sidecar file.","solutions":["Set -Djava.security.auth.login.config=/path/to/jaas.conf (the standard property) pointing at an existing JAAS file","Add a section named exactly as loginContextName, e.g. 'PulsarClient { com.sun.security.auth.module.Krb5LoginModule required ...; };'","Verify the JAAS file is readable by the process and mounted in containers","Confirm the section header spelling matches the configured loginContextName"],"exampleFix":"// before\n// no JAAS config supplied -> LoginException\n// after (jaas.conf)\nPulsarClient {\n  com.sun.security.auth.module.Krb5LoginModule required\n  useKeyTab=true keyTab=\"/etc/security/pulsar.keytab\"\n  principal=\"pulsar/host@REALM\";\n};\n// launch with: -Djava.security.auth.login.config=/etc/pulsar/jaas.conf","handlingStrategy":"validation","validationCode":"// Verify JAAS config is resolvable before constructing credentials\nString config = System.getProperty(\"java.security.auth.login.config\");\nif (config == null || !new java.io.File(config).canRead()) {\n    throw new IllegalStateException(\"JAAS config file missing/unreadable: \" + config);\n}\njavax.security.auth.login.Configuration cfg =\n    javax.security.auth.login.Configuration.getConfiguration();\nif (cfg.getAppConfigurationEntry(\"PulsarClient\") == null) {\n    throw new IllegalStateException(\"JAAS section 'PulsarClient' not found in \" + config);\n}","typeGuard":"static boolean jaasSectionExists(String loginContextName) {\n    try {\n        return javax.security.auth.login.Configuration.getConfiguration()\n            .getAppConfigurationEntry(loginContextName) != null;\n    } catch (Exception e) { return false; }\n}","tryCatchPattern":"try {\n    container = new JAASCredentialsContainer(subject, handler, \"PulsarClient\", serviceName);\n} catch (LoginException e) {\n    log.error(\"JAAS login failed — check -Djava.security.auth.login.config and section name: {}\", e.getMessage());\n    throw new AuthenticationException(\"Kerberos/JAAS configuration invalid\", e);\n}","preventionTips":["Always launch with -Djava.security.auth.login.config pointing to a mounted JAAS file","Name JAAS sections exactly as the loginContextName used in code","Check file readability inside containers (permissions, mount) at startup","Fail fast in a startup health check that verifies JAAS sections exist"],"tags":["kerberos","sasl","jaas","configuration"],"backgroundTag":"missing-jaas-config","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}