{"record":{"id":"e48741c271fd1d7b","repo":"apache/seatunnel","slug":"kerberos-re-login-from-keytab-failed","errorCode":null,"errorMessage":"Kerberos re-login from keytab failed: {}","messagePattern":"Kerberos re-login from keytab failed: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-file/connector-file-base/src/main/java/org/apache/seatunnel/connectors/seatunnel/file/hadoop/HadoopFileSystemProxy.java","lineNumber":549,"sourceCode":"        } catch (InterruptedException e) {\n            Thread.currentThread().interrupt();\n            throw new IOException(e);\n        }\n    }\n\n    private void maybeRelogin() {\n        if (!isAuthTypeKerberos) {\n            return;\n        }\n        if (userGroupInformation == null) {\n            return;\n        }\n        try {\n            if (userGroupInformation.isFromKeytab()) {\n                userGroupInformation.checkTGTAndReloginFromKeytab();\n            }\n        } catch (IOException e) {\n            log.warn(\"Kerberos re-login from keytab failed: {}\", e.getMessage());\n        }\n    }\n}\n","sourceCodeStart":531,"sourceCodeEnd":553,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-file/connector-file-base/src/main/java/org/apache/seatunnel/connectors/seatunnel/file/hadoop/HadoopFileSystemProxy.java#L531-L553","documentation":"A WARN from HadoopFileSystemProxy.maybeRelogin: the periodic Kerberos TGT refresh (UserGroupInformation.checkTGTAndReloginFromKeytab) threw an IOException. The current operation (wrapped in doAsPrivileged) still proceeds with the existing credentials; if the TGT is truly expired, subsequent HDFS/file operations will fail with authentication errors.","triggerScenarios":"doAsPrivileged -> maybeRelogin runs before file operations; UGI.isFromKeytab() is true but checkTGTAndReloginFromKeytab fails — keytab file missing/unreadable, KDC unreachable, principal mismatch, or clock skew between client and KDC.","commonSituations":"Long-running jobs whose TGT lifetime (e.g. 24h) expires mid-run with a misconfigured keytab path; krb5.conf pointing to an unreachable KDC; wrong principal in the keytab; VM clock drift breaking Kerberos time validation.","solutions":["Verify kerberos_principal, kerberos_keytab_path in the source/sink config point to an existing, readable keytab with the matching principal","Test kinit -kt <keytab> <principal> on the SeaTunnel node and confirm the KDC is reachable from every worker","Check clock sync (ntp/chrony) between client nodes and the KDC","If the error repeats, watch for subsequent 'Failed on local exception' / 'Security token expired' errors — those mean re-login truly failed and the job will fail"],"exampleFix":"// before (typical misconfig)\nkerberos_keytab_path = \"/old/path/user.keytab\"\n// after\nkerberos_keytab_path = \"/etc/security/keytabs/user.keytab\"\nkerberos_principal = \"user@REALM.EXAMPLE.COM\"","handlingStrategy":"validation","validationCode":"// on every worker node before the job:\n// kinit -kt /etc/security/keytabs/user.keytab user@REALM && klist -e\n// and check clock: ntpq -p (or chronyc tracking)","typeGuard":null,"tryCatchPattern":"// re-login failure is swallowed; watch for follow-up auth failures:\n// try { files = listFiles(path); } catch (IOException e) {\n//   if (String.valueOf(e).contains(\"Security\") || String.valueOf(e).contains(\"token expired\")) reKinitAndRetry();\n// }","preventionTips":["Verify keytab path/principal config on every node, not just the client","Keep KDC reachable and clocks synced (chrony/ntp) cluster-wide","Set hdfs-site/core-site Kerberos properties consistently across the job classpath","Alert on this log plus any subsequent 'token expired' errors — together they mean the job will fail"],"tags":["kerberos","hadoop","authentication"],"backgroundTag":"kerberos-relogin-failed","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}