{"record":{"id":"ac70f94aa2e92b0e","repo":"prestodb/presto","slug":"authentication-using-kerberos-requires-ssl-to-be-e","errorCode":null,"errorMessage":"Authentication using Kerberos requires SSL to be enabled","messagePattern":"Authentication using Kerberos requires SSL to be enabled","errorType":"validation","errorClass":"SQLException","httpStatus":null,"severity":"critical","filePath":"presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java","lineNumber":281,"sourceCode":"                    throw new SQLException(\"Authentication using username/password requires SSL to be enabled\");\n                }\n                builder.addInterceptor(basicAuth(getUser(), password));\n            }\n\n            if (useSecureConnection) {\n                setupSsl(\n                        builder,\n                        SSL_KEY_STORE_PATH.getValue(properties),\n                        SSL_KEY_STORE_PASSWORD.getValue(properties),\n                        SSL_KEY_STORE_TYPE.getValue(properties),\n                        SSL_TRUST_STORE_PATH.getValue(properties),\n                        SSL_TRUST_STORE_PASSWORD.getValue(properties),\n                        SSL_TRUST_STORE_TYPE.getValue(properties));\n            }\n\n            if (KERBEROS_REMOTE_SERVICE_NAME.getValue(properties).isPresent()) {\n                if (!useSecureConnection) {\n                    throw new SQLException(\"Authentication using Kerberos requires SSL to be enabled\");\n                }\n                setupKerberos(\n                        builder,\n                        KERBEROS_REMOTE_SERVICE_NAME.getRequiredValue(properties),\n                        KERBEROS_USE_CANONICAL_HOSTNAME.getRequiredValue(properties),\n                        KERBEROS_PRINCIPAL.getValue(properties),\n                        KERBEROS_CONFIG_PATH.getValue(properties),\n                        KERBEROS_KEYTAB_PATH.getValue(properties),\n                        Optional.ofNullable(KERBEROS_CREDENTIAL_CACHE_PATH.getValue(properties)\n                                .orElseGet(() -> defaultCredentialCachePath().map(File::new).orElse(null))));\n            }\n\n            Map<String, String> extraCredentials = EXTRA_CREDENTIALS.getValue(properties).orElse(ImmutableMap.of());\n            Optional.ofNullable(extraCredentials.get(GCS_CREDENTIALS_PATH_KEY))\n                    .ifPresent(credentialPath -> OkHttpUtil.setupGCSOauth(builder, credentialPath, Optional.ofNullable(extraCredentials.get(GCS_OAUTH_SCOPES_KEY))));\n\n            if (ACCESS_TOKEN.getValue(properties).isPresent()) {\n                if (!useSecureConnection) {","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java#L263-L299","documentation":"setupClient() throws SQLException('Authentication using Kerberos requires SSL to be enabled') when Kerberos authentication is configured (KERBEROS_REMOTE_SERVICE_NAME property present) but the connection is not secure. Kerberos credentials/tokens must not transit plain HTTP, so the driver refuses the insecure configuration.","triggerScenarios":"Setting KERBEROS_REMOTE_SERVICE_NAME (plus principal/keytab config) while connecting to a plain http:// jdbc:presto:// URL.","commonSituations":"Enabling Kerberos after moving from an unsecured test cluster but leaving port 8080/http, ops templates that configure Kerberos properties globally while some URLs lack https, TLS termination misconfiguration.","solutions":["Use an https URL (jdbc:presto://host:8443) so useSecureConnection is true","Configure SSL trust settings (SSLTrustStorePath/SSLTrustStorePassword/SSLTrustStoreType) to validate the coordinator certificate","Remove KERBEROS_REMOTE_SERVICE_NAME if Kerberos was not intended for that connection","Ensure the coordinator serves HTTPS with the Kerberos/SPNEGO service configured"],"exampleFix":"// before\nProperties p = new Properties();\np.setProperty(\"user\", \"alice\");\np.setProperty(\"KerberosRemoteServiceName\", \"HTTP\");\nConnection c = DriverManager.getConnection(\"jdbc:presto://host:8080/...\", p);\n// after\np.setProperty(\"SSLTrustStorePath\", \"/etc/presto/truststore.jks\");\np.setProperty(\"SSLTrustStorePassword\", \"changeit\");\nConnection c = DriverManager.getConnection(\"jdbc:presto://host:8443/...\", p);","handlingStrategy":"validation","validationCode":"if (props.getProperty(\"KerberosRemoteServiceName\") != null && !jdbcUrl.replaceFirst(\"jdbc:presto://\", \"\").split(\"/\")[0].matches(\".*:(443|8443)\")) {\n    throw new IllegalArgumentException(\"Kerberos configured but URL is not https\");\n}","typeGuard":null,"tryCatchPattern":"try { return DriverManager.getConnection(url, props); } catch (SQLException e) { if (e.getMessage().contains(\"Kerberos requires SSL\")) { throw new ConfigurationException(\"Switch to https and configure SSLTrustStore properties\", e); } throw e; }","preventionTips":["Pair every Kerberos property set with an https coordinator URL","Set up the trust store before enabling Kerberos","Ensure the coordinator exposes SPNEGO over TLS","Keep connection templates consistent so Kerberos props never leak into http profiles"],"tags":["jdbc","kerberos","ssl","authentication","security"],"backgroundTag":"credentials-over-insecure-connection","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}