{"record":{"id":"caed38576fbecc43","repo":"apache/druid","slug":"keytab-not-defined-in-configuration-caed38","errorCode":null,"errorMessage":"Keytab not defined in configuration","messagePattern":"Keytab not defined in configuration","errorType":"exception","errorClass":"ServletException","httpStatus":500,"severity":"critical","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java","lineNumber":505,"sourceCode":"              KerberosUtil.getKrb5LoginModuleName(),\n              AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,\n              options\n          )\n      };\n    }\n  }\n\n  private void initializeKerberosLogin() throws ServletException\n  {\n    String keytab;\n\n    try {\n      if (serverPrincipal == null || serverPrincipal.trim().length() == 0) {\n        throw new ServletException(\"Principal not defined in configuration\");\n      }\n      keytab = serverKeytab;\n      if (keytab == null || keytab.trim().length() == 0) {\n        throw new ServletException(\"Keytab not defined in configuration\");\n      }\n      if (!new File(keytab).exists()) {\n        throw new ServletException(\"Keytab does not exist: \" + keytab);\n      }\n\n      Set<Principal> principals = new HashSet<>();\n      principals.add(new KerberosPrincipal(serverPrincipal));\n      Subject subject = new Subject(false, principals, new HashSet<>(), new HashSet<>());\n\n      DruidKerberosConfiguration kerberosConfiguration = new DruidKerberosConfiguration(keytab, serverPrincipal);\n\n      log.info(\"Login using keytab \" + keytab + \", for principal \" + serverPrincipal);\n      loginContext = new LoginContext(\"\", subject, null, kerberosConfiguration);\n      loginContext.login();\n\n      log.info(\"Initialized, principal %s from keytab %s\", serverPrincipal, keytab);\n    }\n    catch (Exception ex) {","sourceCodeStart":487,"sourceCodeEnd":523,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java#L487-L523","documentation":"initializeKerberosLogin checks the server keytab (druid.auth.kerberos.serverKeytab) for null/blank before attempting JAAS login. Missing keytab config means the filter cannot log in its server subject, so doFilter fails with a ServletException at startup.","triggerScenarios":"doFilter -> initializeKerberosLogin where serverKeytab is null or empty string despite a valid serverPrincipal.","commonSituations":"serverPrincipal set but serverKeytab forgotten in the authenticator properties; keytab setting removed during config refactor; environment-specific config file not merged.","solutions":["Set druid.auth.kerberos.serverKeytab to a valid absolute keytab path in the authenticator config","Deploy the keytab to all hosts and ensure the druid user can read it","Validate the full kerberos property set (principal + keytab) with klist before restarting"],"exampleFix":"// before\nprops.setProperty(\"druid.auth.kerberos.serverPrincipal\", \"HTTP/_HOST@EXAMPLE.COM\"); // keytab missing\n// after\nprops.setProperty(\"druid.auth.kerberos.serverKeytab\", \"/etc/security/keytabs/http.keytab\");","handlingStrategy":"validation","validationCode":"String keytab = props.getProperty(\"druid.auth.kerberos.serverKeytab\");\nif (keytab == null || keytab.trim().isEmpty()) {\n  throw new IllegalStateException(\"druid.auth.kerberos.serverKeytab must be set\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  authenticator.init(config);\n} catch (ServletException e) {\n  if (e.getMessage().contains(\"Keytab not defined\")) { log.error(\"serverKeytab missing in kerberos config\"); }\n  throw e;\n}","preventionTips":["Always set principal + keytab as a pair in the authenticator spec","Add config completeness checks to CI for kerberos-enabled clusters","Use infrastructure-as-code so keytab config is not hand-edited per node"],"tags":["kerberos","configuration","keytab"],"backgroundTag":"missing-required-config-field","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}