{"record":{"id":"b2a23439f652da9d","repo":"apache/seatunnel","slug":"please-set-kerberoskeytabpath-b2a234","errorCode":null,"errorMessage":"Please set kerberosKeytabPath","messagePattern":"Please set kerberosKeytabPath","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-hive/src/main/java/org/apache/seatunnel/connectors/seatunnel/hive/utils/HiveMetaStoreProxyUtils.java","lineNumber":42,"sourceCode":"\n@UtilityClass\npublic class HiveMetaStoreProxyUtils {\n\n    public boolean enableKerberos(ReadonlyConfig config) {\n        boolean kerberosPrincipalEmpty =\n                config.getOptional(FileBaseSourceOptions.KERBEROS_PRINCIPAL).isPresent();\n        boolean kerberosKeytabPathEmpty =\n                config.getOptional(FileBaseSourceOptions.KERBEROS_KEYTAB_PATH).isPresent();\n        if (kerberosKeytabPathEmpty && kerberosPrincipalEmpty) {\n            return true;\n        }\n        if (!kerberosPrincipalEmpty && !kerberosKeytabPathEmpty) {\n            return false;\n        }\n        if (kerberosPrincipalEmpty) {\n            throw new IllegalArgumentException(\"Please set kerberosPrincipal\");\n        }\n        throw new IllegalArgumentException(\"Please set kerberosKeytabPath\");\n    }\n\n    public boolean enableRemoteUser(ReadonlyConfig config) {\n        return config.getOptional(FileBaseSourceOptions.REMOTE_USER).isPresent();\n    }\n}\n","sourceCodeStart":24,"sourceCodeEnd":49,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-hive/src/main/java/org/apache/seatunnel/connectors/seatunnel/hive/utils/HiveMetaStoreProxyUtils.java#L24-L49","documentation":"IllegalArgumentException thrown by HiveMetaStoreProxyUtils.enableKerberos when a kerberosPrincipal is supplied but kerberosKeytabPath is missing/empty. Both principal and keytab are required to perform a kerberos login against the Hive Metastore.","triggerScenarios":"enableKerberos(config) called with kerberosPrincipal set but kerberosKeytabPath empty or absent.","commonSituations":"Setting the principal but forgetting the keytab path; keytab file path typo resolving through config validation as empty; provisioning the keytab only on some worker nodes and leaving config unset there.","solutions":["Add auth.kerberos-keytab-path pointing to an existing keytab file accessible on all nodes","Confirm the keytab path resolves (no trailing whitespace/empty env substitution)","If kerberos is not intended, remove auth.kerberos-principal too","Pre-check both options before enabling kerberos"],"exampleFix":"// before\nHive {\n  auth.kerberos-principal = \"hive/_HOST@EXAMPLE.COM\"\n}\n// after\nHive {\n  auth.kerberos-principal = \"hive/_HOST@EXAMPLE.COM\"\n  auth.kerberos-keytab-path = \"/etc/security/keytabs/hive.keytab\"\n}","handlingStrategy":"validation","validationCode":"boolean keytabSet = Optional.ofNullable(config.get(KEYTAB_PATH)).map(p -> !p.trim().isEmpty() && new File(p).exists()).orElse(false);","typeGuard":"boolean keytabValid = path != null && !path.trim().isEmpty() && new File(path).isFile();","tryCatchPattern":"try { enableKerberos(config); } catch (IllegalArgumentException e) { throw new IllegalArgumentException(\"kerberosKeytabPath required: \" + e.getMessage()); }","preventionTips":["Deploy keytabs to all nodes at a consistent path","Verify file existence at startup, not just presence in config","Set principal and keytab as a pair","Document required kerberos options for users"],"tags":["hive","kerberos","config"],"backgroundTag":"missing-required-config-field","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}