{"record":{"id":"b19d4a850bd88fe0","repo":"apache/seatunnel","slug":"hadoop-security-authentication-must-be-kerberos","errorCode":null,"errorMessage":"hadoop.security.authentication must be kerberos","messagePattern":"hadoop\\.security\\.authentication must be kerberos","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-file/connector-file-base/src/main/java/org/apache/seatunnel/connectors/seatunnel/file/hadoop/HadoopLoginFactory.java","lineNumber":39,"sourceCode":"\nimport org.apache.hadoop.conf.Configuration;\nimport org.apache.hadoop.security.UserGroupInformation;\n\nimport java.io.IOException;\nimport java.security.PrivilegedExceptionAction;\n\npublic class HadoopLoginFactory {\n\n    /** Login with kerberos, and do the given action after login successfully. */\n    public static <T> T loginWithKerberos(\n            Configuration configuration,\n            String krb5FilePath,\n            String kerberosPrincipal,\n            String kerberosKeytabPath,\n            LoginFunction<T> action)\n            throws IOException, InterruptedException {\n        if (!configuration.get(\"hadoop.security.authentication\").equals(\"kerberos\")) {\n            throw new IllegalArgumentException(\"hadoop.security.authentication must be kerberos\");\n        }\n        // Use global lock to avoid multiple threads to execute setConfiguration at the same time\n        synchronized (UserGroupInformation.class) {\n            if (StringUtils.isNotEmpty(krb5FilePath)) {\n                System.setProperty(\"java.security.krb5.conf\", krb5FilePath);\n            }\n            // init configuration\n            UserGroupInformation.setConfiguration(configuration);\n            UserGroupInformation userGroupInformation =\n                    UserGroupInformation.loginUserFromKeytabAndReturnUGI(\n                            kerberosPrincipal, kerberosKeytabPath);\n            return userGroupInformation.doAs(\n                    (PrivilegedExceptionAction<T>)\n                            () -> action.run(configuration, userGroupInformation));\n        }\n    }\n\n    /** Login with remote user, and do the given action after login successfully. */","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-file/connector-file-base/src/main/java/org/apache/seatunnel/connectors/seatunnel/file/hadoop/HadoopLoginFactory.java#L21-L57","documentation":"HadoopLoginFactory.loginWithKerberos only performs Kerberos login when the Hadoop configuration has hadoop.security.authentication set to 'kerberos'. Before logging in it asserts this property; if it is missing or set to anything else (e.g. 'simple', the default), it throws IllegalArgumentException.","triggerScenarios":"Calling the file connector with Kerberos options (principal/keytab) while the underlying Hadoop configuration (core-site.xml or programmatically built Configuration) lacks hadoop.security.authentication = kerberos.","commonSituations":"Not placing the cluster's core-site.xml (and hdfs-site.xml) on the classpath or not referencing it via krb configs; a minimal Configuration object built only from connector options; cluster downgraded/reconfigured from Kerberos to simple auth.","solutions":["Copy the cluster's core-site.xml (with hadoop.security.authentication = kerberos) into the SeaTunnel classpath/config directory","Set the property programmatically or in the connector config as supported (e.g. via hadoop security config / 'hadoop.security.authentication' = 'kerberos')","If the cluster uses simple auth, remove the Kerberos options instead of enabling Kerberos login"],"exampleFix":"// before (config lacks hadoop auth)\nHdfsFile {\n  kerberos_principal = \"hdfs@EXAMPLE.COM\"\n  kerberos_keytab_path = \"/etc/security/keytab/hdfs.keytab\"\n}\n// after\nHdfsFile {\n  kerberos_principal = \"hdfs@EXAMPLE.COM\"\n  kerberos_keytab_path = \"/etc/security/keytab/hdfs.keytab\"\n  hadoop_user_name = \"hdfs\"\n}\n// plus ensure core-site.xml on classpath contains:\n// <property><name>hadoop.security.authentication</name><value>kerberos</value></property>","handlingStrategy":"validation","validationCode":"if (config.get(\"kerberos_principal\") != null && !\"kerberos\".equals(hadoopConf.get(\"hadoop.security.authentication\"))) {\n    throw new IllegalArgumentException(\"Kerberos options require hadoop.security.authentication=kerberos in core-site.xml\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Place the cluster's core-site.xml on the SeaTunnel classpath when using Kerberos","Only use Kerberos login options when the target cluster actually runs Kerberos auth"],"tags":["kerberos","hadoop","config"],"backgroundTag":"invalid-config-value","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}