{"record":{"id":"bc89eededc0c5060","repo":"apache/hadoop","slug":"h01","errorCode":"H01","errorMessage":"Service property [{0}] not defined","messagePattern":"Service property \\[(.+?)\\] not defined","errorType":"error_code","errorClass":"ServiceException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/lib/service/hadoop/FileSystemAccessService.java","lineNumber":157,"sourceCode":"  private Configuration fileSystemConf;\n\n  private AtomicInteger unmanagedFileSystems = new AtomicInteger();\n\n  private ConcurrentHashMap<String, CachedFileSystem> fsCache =\n    new ConcurrentHashMap<String, CachedFileSystem>();\n\n  private long purgeTimeout;\n\n  @Override\n  protected void init() throws ServiceException {\n    LOG.info(\"Using FileSystemAccess JARs version [{}]\", VersionInfo.getVersion());\n    String security = getServiceConfig().get(AUTHENTICATION_TYPE, \"simple\").trim();\n    if (security.equals(\"kerberos\")) {\n      String defaultName = getServer().getName();\n      String keytab = System.getProperty(\"user.home\") + \"/\" + defaultName + \".keytab\";\n      keytab = getServiceConfig().get(KERBEROS_KEYTAB, keytab).trim();\n      if (keytab.length() == 0) {\n        throw new ServiceException(FileSystemAccessException.ERROR.H01, KERBEROS_KEYTAB);\n      }\n      String principal = defaultName + \"/localhost@LOCALHOST\";\n      principal = getServiceConfig().get(KERBEROS_PRINCIPAL, principal).trim();\n      if (principal.length() == 0) {\n        throw new ServiceException(FileSystemAccessException.ERROR.H01, KERBEROS_PRINCIPAL);\n      }\n      Configuration conf = new Configuration();\n      conf.set(HADOOP_SECURITY_AUTHENTICATION, \"kerberos\");\n      UserGroupInformation.setConfiguration(conf);\n      try {\n        UserGroupInformation.loginUserFromKeytab(principal, keytab);\n      } catch (IOException ex) {\n        throw new ServiceException(FileSystemAccessException.ERROR.H02, ex.getMessage(), ex);\n      }\n      LOG.info(\"Using FileSystemAccess Kerberos authentication, principal [{}] keytab [{}]\", principal, keytab);\n    } else if (security.equals(\"simple\")) {\n      Configuration conf = new Configuration();\n      conf.set(HADOOP_SECURITY_AUTHENTICATION, \"simple\");","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/lib/service/hadoop/FileSystemAccessService.java#L139-L175","documentation":"When httpfs.hadoop.authentication.type is set to 'kerberos', FileSystemAccessService resolves the keytab via the httpfs.hadoop.authentication.kerberos.keytab property (default ${user.home}/httpfs.keytab). Error H01 ('Service property not defined') is thrown at service init if the trimmed keytab value is empty, i.e. the property was explicitly set to a blank value.","triggerScenarios":"httpfs.hadoop.authentication.type=kerberos and httpfs.hadoop.authentication.kerberos.keytab is present in httpfs-site.xml but its value trims to an empty string; startup then aborts during FileSystemAccessService.init().","commonSituations":"A kerberos deployment template was copied with the keytab value left blank; an operator set the property to '' while migrating from the deprecated httpfs.authentication.kerberos.keytab key; environment substitution produced an empty value.","solutions":["Set httpfs.hadoop.authentication.kerberos.keytab in httpfs-site.xml to the absolute path of the httpfs keytab","Ensure the keytab file exists and is readable by the user running httpfs","Also set httpfs.hadoop.authentication.kerberos.principal (the next check throws H01 for it too)","Restart httpfs and confirm the 'Using FileSystemAccess Kerberos authentication' log line"],"exampleFix":"<!-- before -->\n<property><name>httpfs.hadoop.authentication.type</name><value>kerberos</value></property>\n<property><name>httpfs.hadoop.authentication.kerberos.keytab</name><value></value></property>\n\n<!-- after -->\n<property><name>httpfs.hadoop.authentication.type</name><value>kerberos</value></property>\n<property><name>httpfs.hadoop.authentication.kerberos.keytab</name><value>/etc/security/keytabs/httpfs.keytab</value></property>\n<property><name>httpfs.hadoop.authentication.kerberos.principal</name><value>httpfs/_HOST@EXAMPLE.COM</value></property>","handlingStrategy":"validation","validationCode":"String type = conf.get(\"httpfs.hadoop.authentication.type\", \"simple\").trim();\nif (type.equals(\"kerberos\")) {\n  String keytab = conf.get(\"httpfs.hadoop.authentication.kerberos.keytab\", \"\").trim();\n  if (keytab.isEmpty() || !new java.io.File(keytab).canRead()) {\n    throw new IllegalStateException(\"httpfs.hadoop.authentication.kerberos.keytab must be a readable path\");\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Template httpfs-site.xml with required kerberos values, never blank placeholders","Add a config lint step to deployment that rejects empty kerberos.* values when authentication.type=kerberos","Verify the keytab is readable by the httpfs daemon user before restart"],"tags":["httpfs","kerberos","configuration","security","keytab"],"backgroundTag":"kerberos-keytab-config-missing","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}