{"record":{"id":"eba679a507a6f763","repo":"spring-projects/spring-security","slug":"kerberos-authentication-failed-eba679","errorCode":null,"errorMessage":"Kerberos authentication failed","messagePattern":"Kerberos authentication failed","errorType":"exception","errorClass":"BadCredentialsException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/SunJaasKerberosClient.java","lineNumber":82,"sourceCode":"\t\t\t\t\tnew KerberosClientCallbackHandler(username, password), new LoginConfig(this.debug));\n\t\t\tloginContext.login();\n\n\t\t\tSubject jaasSubject = loginContext.getSubject();\n\n\t\t\tif (LOG.isDebugEnabled()) {\n\t\t\t\tLOG.debug(\"Kerberos authenticated user: \" + jaasSubject);\n\t\t\t}\n\n\t\t\tString validatedUsername = jaasSubject.getPrincipals().iterator().next().toString();\n\t\t\tSubject subjectCopy = JaasUtil.copySubject(jaasSubject);\n\t\t\tresult = new JaasSubjectHolder(subjectCopy, validatedUsername);\n\n\t\t\tif (!this.multiTier) {\n\t\t\t\tloginContext.logout();\n\t\t\t}\n\t\t}\n\t\tcatch (LoginException ex) {\n\t\t\tthrow new BadCredentialsException(\"Kerberos authentication failed\", ex);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\tpublic void setDebug(boolean debug) {\n\t\tthis.debug = debug;\n\t}\n\n\tpublic void setMultiTier(boolean multiTier) {\n\t\tthis.multiTier = multiTier;\n\t}\n\n\tprivate static final class LoginConfig extends Configuration {\n\n\t\tprivate boolean debug;\n\n\t\tprivate LoginConfig(boolean debug) {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/SunJaasKerberosClient.java#L64-L100","documentation":"SunJaasKerberosClient.login() wraps any javax.security.auth.login.LoginException thrown by the JAAS LoginContext into a BadCredentialsException with this message. It means the JAAS Kerberos login module (Krb5LoginModule) could not authenticate the configured principal, e.g. wrong password, missing keytab, bad realm, or unreachable KDC.","triggerScenarios":"Calling SunJaasKerberosClient.login() with credentials the KDC rejects, a loginContext.login() failure due to a missing/invalid JAAS config or krb5.conf, or an expired/invalid keytab entry; the LoginException is caught in login() and rethrown as BadCredentialsException.","commonSituations":"Misconfigured krb5.conf (wrong default_realm or kdc host), keytab file missing or with stale key version numbers (KVNO mismatch), clock skew beyond the allowed skew between client and KDC, or principal name misspelled in the JAAS login config.","solutions":["Verify /etc/krb5.conf points at the correct realm and KDC and that 'kinit <principal>' succeeds on the host.","Enable JAAS debug (setDebug(true) on SunJaasKerberosClient) and inspect the underlying LoginException cause for the real reason.","If using a keytab, regenerate it with kadmin/ktpass and confirm the KVNO matches the KDC; ensure the file is readable by the JVM user.","Check clock synchronization (NTP) between the application host and the KDC; Kerberos tolerates only ~5 minutes skew.","Confirm the JAAS config file referenced by java.security.auth.login.config contains the correct Krb5LoginModule options."],"exampleFix":"// before\nSunJaasKerberosClient client = new SunJaasKerberosClient();\nclient.setPrincipal(\"HTTP/host@WRONG.REALM\");\nAuthentication auth = client.login(); // LoginException -> BadCredentialsException\n\n// after\nclient.setDebug(true); // diagnose root cause\nclient.setPrincipal(\"HTTP/host.example.com@CORRECT.REALM\");\nSystem.setProperty(\"java.security.krb5.conf\", \"/etc/krb5.conf\");\nAuthentication auth = client.login();","handlingStrategy":"try-catch","validationCode":"// before login()\nif (!new File(\"/etc/krb5.conf\").exists()) throw new IllegalStateException(\"krb5.conf missing\");\nProcess k = new ProcessBuilder(\"klist\", \"-k\").start(); // verify keytab lists principal\nif (k.waitFor() != 0) throw new IllegalStateException(\"keytab unreadable\");","typeGuard":"boolean isPrincipalConfigured(SunJaasKerberosClient c) {\n    return c != null && c.getPrincipal() != null && c.getPrincipal().contains(\"@\");\n}","tryCatchPattern":"try {\n    auth = client.login();\n} catch (BadCredentialsException e) {\n    LOGGER.warn(\"Kerberos login failed: {}\", e.getCause() != null ? e.getCause().toString() : e.getMessage());\n    throw new AuthenticationServiceException(\"kerberos login unavailable\", e);\n}","preventionTips":["Run kinit/klist -k during deployment health checks to validate krb5.conf and keytabs.","Enable setDebug(true) in staging to surface LoginException root causes early.","Monitor NTP skew between app hosts and KDC.","Alert on keytab file permissions and modification times."],"tags":["kerberos","jaas","authentication","spring-security"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}