{"record":{"id":"d7f2165ef2cddd56","repo":"apache/seatunnel","slug":"hadoop-security-authentication-must-be-kerberos-d7f216","errorCode":null,"errorMessage":"hadoop.security.authentication must be kerberos","messagePattern":"hadoop\\.security\\.authentication must be kerberos","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-jdbc/src/main/java/org/apache/seatunnel/connectors/seatunnel/jdbc/internal/dialect/hive/HadoopLoginFactory.java","lineNumber":38,"sourceCode":"import org.apache.hadoop.conf.Configuration;\nimport org.apache.hadoop.security.UserGroupInformation;\n\nimport java.io.IOException;\nimport java.security.PrivilegedExceptionAction;\n\n// todo: Add seatunnel-auth-kerberos module and move this to hive connector\npublic class HadoopLoginFactory {\n\n    /** Login with kerberos, and do the given action after login successfully. */\n    public static <T> T loginWithKerberos(\n            Configuration configuration,\n            String krb5FilePath,\n            String kerberosPrincipal,\n            String kerberosKeytabPath,\n            LoginFunction<T> action)\n            throws IOException, InterruptedException {\n        if (!configuration.get(\"hadoop.security.authentication\").equals(\"kerberos\")) {\n            throw new IllegalArgumentException(\"hadoop.security.authentication must be kerberos\");\n        }\n        // Use global lock to avoid multiple threads to execute setConfiguration at the same time\n        synchronized (UserGroupInformation.class) {\n            System.setProperty(\"java.security.krb5.conf\", krb5FilePath);\n            // init configuration\n            UserGroupInformation.setConfiguration(configuration);\n            UserGroupInformation userGroupInformation =\n                    UserGroupInformation.loginUserFromKeytabAndReturnUGI(\n                            kerberosPrincipal, kerberosKeytabPath);\n            return userGroupInformation.doAs(\n                    (PrivilegedExceptionAction<T>)\n                            () -> action.run(configuration, userGroupInformation));\n        }\n    }\n\n    /** Login with remote user, and do the given action after login successfully. */\n    public static <T> T loginWithRemoteUser(\n            Configuration configuration, String remoteUser, LoginFunction<T> action)","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-jdbc/src/main/java/org/apache/seatunnel/connectors/seatunnel/jdbc/internal/dialect/hive/HadoopLoginFactory.java#L20-L56","documentation":"HadoopLoginFactory.loginWithKerberos requires the Hadoop configuration to explicitly set hadoop.security.authentication=kerberos before attempting a Kerberos login. If the property is absent or set to anything else, this IllegalArgumentException is thrown.","triggerScenarios":"Calling the Kerberos login helper with a Hadoop Configuration that lacks hadoop.security.authentication=kerberos, typically when setting up Hive JDBC Kerberos auth.","commonSituations":"Users supply core-site.xml that does not enable kerberos, or build the Configuration programmatically and forget the property while still passing a principal/keytab.","solutions":["Set configuration.set(\"hadoop.security.authentication\", \"kerberos\") before invoking the login.","Ensure core-site.xml on the classpath contains <name>hadoop.security.authentication</name><value>kerberos</value>.","If Kerberos is not intended, use the non-Kerberos login path instead of loginWithKerberos."],"exampleFix":"// before\nConfiguration conf = new Configuration();\nHadoopLoginFactory.login(conf, krb5, principal, keytab, action);\n// after\nConfiguration conf = new Configuration();\nconf.set(\"hadoop.security.authentication\", \"kerberos\");\nHadoopLoginFactory.login(conf, krb5, principal, keytab, action);","handlingStrategy":"validation","validationCode":"if (!\"kerberos\".equals(conf.get(\"hadoop.security.authentication\"))) { conf.set(\"hadoop.security.authentication\", \"kerberos\"); }","typeGuard":"boolean isKerberosEnabled(org.apache.hadoop.conf.Configuration c) { return \"kerberos\".equals(c.get(\"hadoop.security.authentication\")); }","tryCatchPattern":"try { HadoopLoginFactory.login(...); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"hadoop.security.authentication\")) { /* set the property and retry */ } else throw e; }","preventionTips":["Ensure core-site.xml with hadoop.security.authentication=kerberos is on the classpath","Set the property programmatically before any Kerberos login call","Confirm krb5.conf, principal, and keytab are all provided together"],"tags":["jdbc","hive","kerberos","hadoop"],"backgroundTag":"missing-required-config-field","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}