{"record":{"id":"c5a09f1371034d2c","repo":"apache/druid","slug":"failed-to-login-as-s","errorCode":null,"errorMessage":"Failed to login as [%s]","messagePattern":"Failed to login as \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java","lineNumber":117,"sourceCode":"        spnegoPrincipals = new String[]{principal};\n      }\n\n      String nameRules = config.getProperty(NAME_RULES, null);\n      if (nameRules != null) {\n        KerberosName.setRules(nameRules);\n      }\n\n      for (String spnegoPrincipal : spnegoPrincipals) {\n        log.info(\"Login using keytab %s, for principal %s\", keytab, spnegoPrincipal);\n        final KerberosAuthenticator.DruidKerberosConfiguration kerberosConfiguration =\n            new KerberosAuthenticator.DruidKerberosConfiguration(keytab, spnegoPrincipal);\n        final LoginContext loginContext =\n            new LoginContext(\"\", serverSubject, null, kerberosConfiguration);\n        try {\n          loginContext.login();\n        }\n        catch (LoginException le) {\n          log.warn(le, \"Failed to login as [%s]\", spnegoPrincipal);\n          throw new AuthenticationException(le);\n        }\n        loginContexts.add(loginContext);\n      }\n      try {\n        gssManager = Subject.doAs(serverSubject, new PrivilegedExceptionAction<>()\n        {\n\n          @Override\n          public GSSManager run()\n          {\n            return GSSManager.getInstance();\n          }\n        });\n      }\n      catch (PrivilegedActionException ex) {\n        throw ex.getException();\n      }","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosAuthenticationHandler.java#L99-L135","documentation":"DruidKerberosAuthenticationHandler.init() performs a JAAS LoginContext.login() for the server subject using the SPNEGO principal. If Kerberos login fails (LoginException), it logs this warning and throws an AuthenticationException, so the authentication handler fails to initialize. Typical root causes: missing/bad keytab, wrong principal, stale ticket, or broken krb5/JAAS configuration.","triggerScenarios":"init() runs loginContext.login() with kerberosConfiguration; thrown when the spnegoPrincipal cannot authenticate: keytab file missing or unreadable, principal not present in keytab, unsupported/faulty encryption types, invalid krb5.conf, expired credentials.","commonSituations":"Wrong druid.auth.kerberos.principal/server config vs. actual keytab entries; keytab not deployed or wrong permissions on the node; ktutil/kadmin keytab regenerated without redeploy; KDC unreachable or DNS/realm misconfiguration.","solutions":["Verify the principal in the keytab: run `klist -kt /path/to/keytab` and confirm it contains the spnegoPrincipal exactly (realm case included).","Check file permissions/readability of the keytab and krb5.conf for the Druid process user.","Regenerate the keytab from the KDC if `kinit -kt keytab principal` also fails.","Fix druid.auth.kerberos config properties (principal, keytab path) to match the KDC entries."],"exampleFix":"// before\n// druid.auth.kerberos.principal = HTTP/_HOST@WRONG.REALM\n// after\n// druid.auth.kerberos.principal = HTTP/host.example.com@EXAMPLE.COM\n// druid.auth.kerberos.keytab = /etc/security/keytabs/spnego.service.keytab","handlingStrategy":"validation","validationCode":"# pre-flight before starting Druid\nkinit -kt /etc/security/keytabs/spnego.service.keytab HTTP/host.example.com@EXAMPLE.COM || echo \"keytab/principal invalid\"","typeGuard":null,"tryCatchPattern":"try { new LoginContext(\"\", serverSubject, null, kerberosConfiguration).login(); }\ncatch (LoginException le) { throw new IllegalStateException(\"Check keytab/principal: \" + le.getMessage(), le); }","preventionTips":["Validate keytab with klist -kt and a test kinit before rollout.","Keep keytab paths/permissions consistent across nodes.","Match druid.auth.kerberos.principal exactly to KDC entries.","Monitor KDC reachability and krb5.conf changes."],"tags":["kerberos","spnego","authentication","keytab","startup"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}