{"record":{"id":"bf786a312ab70402","repo":"apache/hadoop","slug":"can-t-obtain-server-kerberos-config-key-from-proto","errorCode":null,"errorMessage":"Can't obtain server Kerberos config key from protocol=","messagePattern":"Can't obtain server Kerberos config key from protocol=","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":313,"sourceCode":"\n  /**\n   * Get the remote server's principal.  The value will be obtained from\n   * the config and cross-checked against the server's advertised principal.\n   * \n   * @param authType of the SASL client\n   * @return String of the server's principal\n   * @throws IOException - error determining configured principal\n   */\n  @VisibleForTesting\n  String getServerPrincipal(SaslAuth authType) throws IOException {\n    KerberosInfo krbInfo = SecurityUtil.getKerberosInfo(protocol, conf);\n    LOG.debug(\"Get kerberos info proto:\" + protocol + \" info:\" + krbInfo);\n    if (krbInfo == null) { // protocol has no support for kerberos\n      return null;\n    }\n    String serverKey = krbInfo.serverPrincipal();\n    if (serverKey == null) {\n      throw new IllegalArgumentException(\n          \"Can't obtain server Kerberos config key from protocol=\"\n              + protocol.getCanonicalName());\n    }\n    // construct server advertised principal for comparision\n    String serverPrincipal = new KerberosPrincipal(\n        authType.getProtocol() + \"/\" + authType.getServerId(),\n        KerberosPrincipal.KRB_NT_SRV_HST).getName();\n\n    // use the pattern if defined\n    String serverKeyPattern = conf.get(serverKey + \".pattern\");\n    if (serverKeyPattern != null && !serverKeyPattern.isEmpty()) {\n      Pattern pattern = GlobPattern.compile(serverKeyPattern);\n      if (!pattern.matcher(serverPrincipal).matches()) {\n        throw new IllegalArgumentException(String.format(\n            \"Server has invalid Kerberos principal: %s,\"\n                + \" doesn't match the pattern: %s\",\n            serverPrincipal, serverKeyPattern));\n      }","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L295-L331","documentation":"Error \"Can't obtain server Kerberos config key from protocol=\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:313 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure a server principal config key for the named protocol (e.g. <protocol>.kerberos.principal or the appropriate *-principal setting).","Ensure the protocol class has an annotated/configured Kerberos principal mapping in server configuration.","Consult the service documentation for the required principal property for this protocol."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}