{"record":{"id":"eccf5defeedb70ee","repo":"apache/druid","slug":"failed-to-authenticate-user-principal-s-with-ke-eccf5d","errorCode":null,"errorMessage":"Failed to authenticate user principal [%s] with keytab [%s]","messagePattern":"Failed to authenticate user principal \\[(.+?)\\] with keytab \\[(.+?)\\]","errorType":"exception","errorClass":"ISE","httpStatus":null,"severity":"critical","filePath":"extensions-core/hdfs-storage/src/main/java/org/apache/druid/storage/hdfs/HdfsStorageAuthentication.java","lineNumber":70,"sourceCode":"   * In case of any bug fix make sure to fix the code in JobHelper#authenticate as well.\n   */\n  @LifecycleStart\n  public void authenticate()\n  {\n    String principal = hdfsKerberosConfig.getPrincipal();\n    String keytab = hdfsKerberosConfig.getKeytab();\n    if (!Strings.isNullOrEmpty(principal) && !Strings.isNullOrEmpty(keytab)) {\n      UserGroupInformation.setConfiguration(hadoopConf);\n      if (UserGroupInformation.isSecurityEnabled()) {\n        try {\n          if (UserGroupInformation.getCurrentUser().hasKerberosCredentials() == false\n              || !UserGroupInformation.getCurrentUser().getUserName().equals(principal)) {\n            log.info(\"Trying to authenticate user [%s] with keytab [%s]..\", principal, keytab);\n            UserGroupInformation.loginUserFromKeytab(principal, keytab);\n          }\n        }\n        catch (IOException e) {\n          throw new ISE(e, \"Failed to authenticate user principal [%s] with keytab [%s]\", principal, keytab);\n        }\n      }\n    }\n  }\n\n  @LifecycleStop\n  public void stop()\n  {\n    //noop\n  }\n}\n","sourceCodeStart":52,"sourceCodeEnd":82,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/hdfs-storage/src/main/java/org/apache/druid/storage/hdfs/HdfsStorageAuthentication.java#L52-L82","documentation":"HdfsStorageAuthentication.authenticate() performs Kerberos login via UserGroupInformation.loginUserFromKeytab(principal, keytab). Any IOException during login is wrapped in this ISE naming the principal and keytab. It means Kerberos authentication for HDFS access failed.","triggerScenarios":"authenticate(principal, keytab) is called (during lifecycle start) and loginUserFromKeytab throws: keytab file missing/unreadable, wrong principal name not present in the keytab, invalid/expired keytab, or Kerberos KDC unreachable / clock skew.","commonSituations":"Wrong druid.hadoop.security.kerberos.principal/keytab paths; keytab not distributed to all nodes; hostname mismatch between principal and host; missing krb5.conf; expired keytabs after rotation.","solutions":["Verify the keytab file exists and is readable by the Druid user on every node","Confirm the principal in the keytab exactly matches the configured principal (use klist -kt keytab)","Test manually with kinit -kt <keytab> <principal> and check krb5.conf / KDC reachability and clock sync","Replace the keytab if rotated/expired and restart the node"],"exampleFix":"// before (wrong path)\ndruid.hadoop.security.kerberos.principal=druid/_HOST@EXAMPLE.COM\ndruid.hadoop.security.kerberos.keytab=/etc/druid/conf/old.keytab\n// after\ndruid.hadoop.security.kerberos.principal=druid/_HOST@EXAMPLE.COM\ndruid.hadoop.security.kerberos.keytab=/etc/security/keytabs/druid.keytab","handlingStrategy":"validation","validationCode":"File keytabFile = new File(keytabPath);\nif (!keytabFile.canRead()) throw new IllegalStateException(\"Keytab missing/unreadable: \" + keytabPath);\n// verify principal with: klist -kt keytab","typeGuard":"null","tryCatchPattern":"try {\n  hdfsAuth.authenticate();\n} catch (IllegalStateException e) {\n  log.error(\"Kerberos login failed; check keytab/principal/KDC\", e);\n  // alert and stop instead of continuing with anonymous HDFS access\n  throw e;\n}","preventionTips":["Distribute and rotate keytabs on all nodes with correct ownership/permissions","Test kinit -kt <keytab> <principal> outside Druid before startup","Keep krb5.conf and clock sync (NTP) correct; monitor KDC reachability"],"tags":["kerberos","authentication","hdfs","security"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}