{"record":{"id":"ed9c9a47a27ff69a","repo":"apache/druid","slug":"failed-to-authenticate-user-principal-s-with-ke-ed9c9a","errorCode":null,"errorMessage":"Failed to authenticate user principal [%s] with keytab [%s]","messagePattern":"Failed to authenticate user principal \\[(.+?)\\] with keytab \\[(.+?)\\]","errorType":"exception","errorClass":"IllegalStateException","httpStatus":500,"severity":"error","filePath":"extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosUtil.java","lineNumber":119,"sourceCode":"        if (UserGroupInformation.getCurrentUser().hasKerberosCredentials() == false\n            || !UserGroupInformation.getCurrentUser().getUserName().equals(internalClientPrincipal)) {\n          log.info(\"trying to authenticate user [%s] with keytab [%s]\", internalClientPrincipal, internalClientKeytab);\n          UserGroupInformation.loginUserFromKeytab(internalClientPrincipal, internalClientKeytab);\n          return;\n        }\n        //try to relogin in case the TGT expired\n        if (UserGroupInformation.isLoginKeytabBased()) {\n          log.info(\"Re-Login from key tab [%s] with principal [%s]\", internalClientKeytab, internalClientPrincipal);\n          UserGroupInformation.getLoginUser().checkTGTAndReloginFromKeytab();\n          return;\n        } else if (UserGroupInformation.isLoginTicketBased()) {\n          log.info(\"Re-Login from Ticket cache\");\n          UserGroupInformation.getLoginUser().reloginFromTicketCache();\n          return;\n        }\n      }\n      catch (IOException e) {\n        throw new ISE(\n            e,\n            \"Failed to authenticate user principal [%s] with keytab [%s]\",\n            internalClientPrincipal,\n            internalClientKeytab\n        );\n      }\n    }\n  }\n\n  public static boolean needToSendCredentials(CookieStore cookieStore, URI uri)\n  {\n    return getAuthCookie(cookieStore, uri) == null;\n  }\n\n  public static HttpCookie getAuthCookie(CookieStore cookieStore, URI uri)\n  {\n    if (cookieStore == null) {\n      return null;","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/DruidKerberosUtil.java#L101-L137","documentation":"KerberosAuthenticator's client-side login helper catches an IOException raised by Hadoop's UserGroupInformation login/keytab re-login machinery and rethrows it as an ISE. It means UGI could not authenticate the configured internal client principal against the client keytab.","triggerScenarios":"authenticateIfRequired() triggers UGI.loginUserFromKeytab / relogin and the underlying JAAS login throws IOException (unreadable keytab, wrong principal, KDC unreachable, clock skew).","commonSituations":"druid.client-internal kerberos keytab/principal misconfigured; keytab rotated and principal removed; KDC temporarily down; ticket renewal failing due to time drift between nodes.","solutions":["Verify druid.auth.kerberos.clientKeytab/clientPrincipal (internal client settings) are correct and the keytab exists and is readable","Run kinit -kt <keytab> <principal> on the host to confirm the principal is valid against the KDC","Check KDC reachability and NTP/clock synchronization","Inspect the wrapped IOException cause for the concrete JAAS failure"],"exampleFix":"// before\n// principal changed after rotation\nprops.setProperty(\"druid.auth.kerberos.internal.clientPrincipal\", \"old_user@EXAMPLE.COM\");\n// after\nprops.setProperty(\"druid.auth.kerberos.internal.clientPrincipal\", \"druid@EXAMPLE.COM\");","handlingStrategy":"try-catch","validationCode":"// before use, verify principal against KDC:\n// kinit -kt /path/client.keytab druid@EXAMPLE.COM && klist","typeGuard":null,"tryCatchPattern":"try {\n  kerberosUtil.authenticateIfRequired();\n} catch (ISE e) {\n  log.error(\"Kerberos client login failed; check keytab/principal/KDC\", e.getCause());\n  throw e;\n}","preventionTips":["Keep client principal/keytab config in sync with KDC rotations","Monitor NTP skew cluster-wide; clock drift breaks Kerberos","Alert on KDC unavailability before it surfaces as login IOExceptions"],"tags":["kerberos","authentication","ugi"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}