{"record":{"id":"c6071c91f822697e","repo":"apache/pulsar","slug":"can-t-get-kerberos-configuration","errorCode":null,"errorMessage":"Can't get Kerberos configuration","messagePattern":"Can't get Kerberos configuration","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java","lineNumber":102,"sourceCode":"        if (System.getProperty(\"java.vendor\").contains(\"IBM\")) {\n            classRef = Class.forName(\"com.ibm.security.krb5.internal.Config\");\n        } else {\n            classRef = Class.forName(\"sun.security.krb5.Config\");\n        }\n        getInstanceMethod = classRef.getMethod(\"getInstance\");\n        kerbConf = getInstanceMethod.invoke(classRef);\n        getDefaultRealmMethod = classRef.getDeclaredMethod(\"getDefaultRealm\"\n        );\n        return (String) getDefaultRealmMethod.invoke(kerbConf, new Object[0]);\n    }\n\n    static {\n        try {\n            defaultRealm = getDefaultRealm2();\n        } catch (Exception ke) {\n            if ((System.getProperty(\"zookeeper.requireKerberosConfig\") != null)\n                && (System.getProperty(\"zookeeper.requireKerberosConfig\").equals(\"true\"))) {\n                throw new IllegalArgumentException(\"Can't get Kerberos configuration\", ke);\n            } else {\n                defaultRealm = \"\";\n            }\n        }\n        try {\n            // setConfiguration() will work even if the above try() fails due\n            // to a missing Kerberos configuration (unless zookeeper.requireKerberosConfig\n            // is set to true, which would not allow execution to reach here due to the\n            // throwing of an IllegalArgumentException above).\n            setConfiguration();\n        } catch (IOException e) {\n            throw new IllegalArgumentException(\"Could not configure Kerberos principal name mapping.\");\n        }\n    }\n\n    /**\n     * Create a name from the full Kerberos principal name.\n     * @param name","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/sasl/KerberosName.java#L84-L120","documentation":"KerberosName's static initializer resolves the default Kerberos realm via getDefaultRealm2() (parsing krb5.conf / sun.security.krb5.Config). If that fails and the zookeeper.requireKerberosConfig system property is set to true, it throws IllegalArgumentException('Can't get Kerberos configuration'); otherwise it degrades to an empty default realm.","triggerScenarios":"Class-loading KerberosName when Kerberos configuration cannot be read (missing /etc/krb5.conf, malformed krb5.conf, missing default_realm) while -Dzookeeper.requireKerberosConfig=true.","commonSituations":"Containers without krb5.conf; Kerberos config in a non-default path without KRB5_CONFIG set; typo in krb5.conf making it unparseable; deliberately strict deployments enabling requireKerberosConfig.","solutions":["Install/restore a valid /etc/krb5.conf with [libdefaults] default_realm set","Set KRB5_CONFIG to the actual location of the Kerberos config file","Fix syntax errors in krb5.conf and verify with 'kvno' or kinit","If Kerberos is optional, unset zookeeper.requireKerberosConfig so startup degrades gracefully"],"exampleFix":"// before (krb5.conf)\n[libdefaults]\n  missing_realm_directive\n// after\n[libdefaults]\n  default_realm = EXAMPLE.COM\n[realms]\n  EXAMPLE.COM = { kdc = kdc.example.com }","handlingStrategy":"validation","validationCode":"// Check Kerberos config presence before touching KerberosName\nString krb5 = System.getenv().getOrDefault(\"KRB5_CONFIG\", \"/etc/krb5.conf\");\njava.io.File f = new java.io.File(krb5);\nif (!f.canRead() || !new String(java.nio.file.Files.readAllBytes(f.toPath())).contains(\"default_realm\")) {\n    throw new IllegalStateException(\"Invalid Kerberos config at \" + krb5);\n}","typeGuard":"static boolean kerberosConfigPresent() {\n    String p = System.getenv(\"KRB5_CONFIG\");\n    return p == null ? new java.io.File(\"/etc/krb5.conf\").canRead()\n                     : new java.io.File(p).canRead();\n}","tryCatchPattern":"try {\n    Class.forName(\"org.apache.pulsar.common.sasl.KerberosName\");\n} catch (Throwable t) {\n    Throwable cause = t.getCause();\n    log.error(\"Kerberos config unavailable: {}\", cause == null ? t : cause);\n    if (Boolean.getBoolean(\"zookeeper.requireKerberosConfig\")) throw t;\n    log.warn(\"Continuing without default realm\");\n}","preventionTips":["Ship a valid krb5.conf in container images when Kerberos is used","Set KRB5_CONFIG explicitly when config is outside /etc/krb5.conf","Validate krb5.conf syntax in CI/startup (kinit -k or kvno smoke test)","Only set zookeeper.requireKerberosConfig=true when Kerberos is mandatory"],"tags":["kerberos","configuration","startup"],"backgroundTag":"missing-kerberos-config","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}