{"record":{"id":"bb8e4bee8cbe4514","repo":"apache/seatunnel","slug":"commonerrorcode-kerberos-authorized-failed","errorCode":"CommonErrorCode.KERBEROS_AUTHORIZED_FAILED","errorMessage":"Kerberos authentication failed: %s","messagePattern":"Kerberos authentication failed: (.+?)","errorType":"error_code","errorClass":"IcebergConnectorException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java","lineNumber":145,"sourceCode":"    /**\n     * kerberos authentication\n     *\n     * @param configuration Configuration\n     */\n    private Configuration doKerberosLogin(Configuration configuration) {\n        String kerberosKrb5ConfPath = config.getKerberosKrb5ConfPath();\n        String kerberosKeytabPath = config.getKerberosKeytabPath();\n        String kerberosPrincipal = config.getKerberosPrincipal();\n\n        if (StringUtils.isNotEmpty(kerberosPrincipal)\n                && StringUtils.isNotEmpty(kerberosKrb5ConfPath)\n                && StringUtils.isNotEmpty(kerberosKeytabPath)) {\n            try {\n                System.setProperty(\"java.security.krb5.conf\", kerberosKrb5ConfPath);\n                System.setProperty(\"krb.principal\", kerberosPrincipal);\n                doKerberosAuthentication(configuration, kerberosPrincipal, kerberosKeytabPath);\n            } catch (Exception e) {\n                throw new IcebergConnectorException(\n                        CommonErrorCode.KERBEROS_AUTHORIZED_FAILED,\n                        String.format(\"Kerberos authentication failed: %s\", e.getMessage()));\n            }\n        } else {\n            log.warn(\n                    \"Kerberos authentication is not configured, it will skip kerberos authentication\");\n        }\n\n        return configuration;\n    }\n\n    public static void doKerberosAuthentication(\n            Configuration configuration, String principal, String keytabPath) {\n        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {\n            log.warn(\n                    \"Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication\",\n                    principal,\n                    keytabPath);","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java#L127-L163","documentation":"IcebergCatalogLoader.doKerberosLogin wraps any exception from the Kerberos login sequence (setting krb5 conf/principal system properties and UserGroupInformation login from keytab) into an IcebergConnectorException with CommonErrorCode.KERBEROS_AUTHORIZED_FAILED. It signals that the connector could not authenticate to a Kerberized Hadoop/cluster environment while loading the catalog.","triggerScenarios":"loadHadoopConfig detects kerberosPrincipal and kerberosKeytabPath are configured, calls doKerberosAuthentication, and it throws (missing krb5.conf file, bad principal, unreadable/expired keytab, clock skew, wrong realm) — the original message is embedded via %s.","commonSituations":"Wrong path to krb5.conf or keytab file on worker nodes; principal not present in the KDC or keytab; keytab/ktutil generated for wrong principal or enctypes unsupported by the JVM (e.g. missing JCE); hostname/reverse-DNS mismatch causing 'Server not found in Kerberos database'.","solutions":["Read the embedded cause (%s) and fix the underlying Kerberos error — most often fix the keytab path, principal spelling, or krb5.conf path in the connector config","Verify the keytab exists and is readable on every worker node and contains the configured principal (klist -kt <keytab>)","Test authentication outside SeaTunnel with kinit -kt <keytab> <principal> to isolate KDC/realm/ENCTYPE issues","Ensure krb5.conf has correct realms/KDC entries and the hosts involved have correct forward/reverse DNS","Install unlimited-strength JCE policy files if you see 'no supported default etypes' style errors"],"exampleFix":"// before\nKerberos { principal = \"user@WRONG.REALM\", keytab_path = \"/etc/keytabs/stale.keytab\", krb5_conf_path = \"/missing/krb5.conf\" }\n// after\nKerberos { principal = \"user@EXAMPLE.COM\", keytab_path = \"/etc/security/keytabs/user.keytab\", krb5_conf_path = \"/etc/krb5.conf\" }","handlingStrategy":"try-catch","validationCode":"// Pre-flight check before submitting the job\nProcess p = new ProcessBuilder(\"kinit\", \"-kt\", keytabPath, principal).start();\nif (p.waitFor() != 0) throw new IllegalStateException(\"kinit failed; fix keytab/principal before running\");\nif (!new File(krb5ConfPath).canRead()) throw new IllegalStateException(\"krb5.conf missing: \" + krb5ConfPath);","typeGuard":null,"tryCatchPattern":"try {\n  catalogLoader.loadCatalog();\n} catch (IcebergConnectorException e) {\n  if (CommonErrorCode.KERBEROS_AUTHORIZED_FAILED.equals(e.getCode())) {\n    // surface e.getMessage() (contains root cause), fix keytab/krb5.conf, re-kinit\n  } else throw e;\n}","preventionTips":["Distribute keytab and krb5.conf to every worker node with correct permissions","Validate principal+keytab with kinit outside the connector first","Keep realms/KDC entries in krb5.conf correct and DNS consistent","Match JVM enctypes/JCE policy to the keytab's encryption types"],"tags":["iceberg","kerberos","authentication","hadoop"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}