{"record":{"id":"e1d43af197d87b39","repo":"apache/hadoop","slug":"kerberos-principal-name-does-not-have-the-expected","errorCode":null,"errorMessage":"Kerberos principal name does NOT have the expected hostname part: ","messagePattern":"Kerberos principal name does NOT have the expected hostname part: ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":346,"sourceCode":"            \"Server has invalid Kerberos principal: %s,\"\n                + \" doesn't match the pattern: %s\",\n            serverPrincipal, serverKeyPattern));\n      }\n    } else {\n      // check that the server advertised principal matches our conf\n      String confPrincipal = SecurityUtil.getServerPrincipal(\n          conf.get(serverKey), serverAddr.getAddress());\n      if (LOG.isDebugEnabled()) {\n        LOG.debug(\"getting serverKey: \" + serverKey + \" conf value: \" + conf.get(serverKey)\n            + \" principal: \" + confPrincipal);\n      }\n      if (confPrincipal == null || confPrincipal.isEmpty()) {\n        throw new IllegalArgumentException(\n            \"Failed to specify server's Kerberos principal name\");\n      }\n      KerberosName name = new KerberosName(confPrincipal);\n      if (name.getHostName() == null) {\n        throw new IllegalArgumentException(\n            \"Kerberos principal name does NOT have the expected hostname part: \"\n                + confPrincipal);\n      }\n      if (!serverPrincipal.equals(confPrincipal)) {\n        throw new IllegalArgumentException(String.format(\n            \"Server has invalid Kerberos principal: %s, expecting: %s\",\n            serverPrincipal, confPrincipal));\n      }\n    }\n    return serverPrincipal;\n  }\n\n  /**\n   * Do client side SASL authentication with server via the given IpcStreams.\n   *\n   * @param ipcStreams ipcStreams.\n   * @return AuthMethod used to negotiate the connection\n   * @throws IOException raised on errors performing I/O.","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L328-L364","documentation":"Error \"Kerberos principal name does NOT have the expected hostname part: \" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:346 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a Kerberos principal of the form service/hostname@REALM; the configured principal lacks a hostname component.","Enable hostname canonicalization or fix reverse DNS so the hostname part can be derived.","Correct the principal in the service configuration to include the fully qualified hostname."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}