{"record":{"id":"edee6ee61fc929ee","repo":"apache/seatunnel","slug":"principal-or-keytabpath-is-empty-it-wil","errorCode":null,"errorMessage":"Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication","messagePattern":"Principal \\[(.+?)\\] or keytabPath \\[(.+?)\\] is empty, it will skip kerberos authentication","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java","lineNumber":160,"sourceCode":"                System.setProperty(\"krb.principal\", kerberosPrincipal);\n                doKerberosAuthentication(configuration, kerberosPrincipal, kerberosKeytabPath);\n            } catch (Exception e) {\n                throw new IcebergConnectorException(\n                        CommonErrorCode.KERBEROS_AUTHORIZED_FAILED,\n                        String.format(\"Kerberos authentication failed: %s\", e.getMessage()));\n            }\n        } else {\n            log.warn(\n                    \"Kerberos authentication is not configured, it will skip kerberos authentication\");\n        }\n\n        return configuration;\n    }\n\n    public static void doKerberosAuthentication(\n            Configuration configuration, String principal, String keytabPath) {\n        if (StringUtils.isBlank(principal) || StringUtils.isBlank(keytabPath)) {\n            log.warn(\n                    \"Principal [{}] or keytabPath [{}] is empty, it will skip kerberos authentication\",\n                    principal,\n                    keytabPath);\n        } else {\n            configuration.set(\"hadoop.security.authentication\", \"kerberos\");\n            UserGroupInformation.setConfiguration(configuration);\n            try {\n                log.info(\n                        \"Start Kerberos authentication using principal {} and keytab {}\",\n                        principal,\n                        keytabPath);\n                UserGroupInformation.loginUserFromKeytab(principal, keytabPath);\n                UserGroupInformation loginUser = UserGroupInformation.getLoginUser();\n                log.info(\"Kerberos authentication successful,UGI {}\", loginUser);\n            } catch (IOException e) {\n                throw new SeaTunnelException(\"check connectivity failed, \" + e.getMessage(), e);\n            }\n        }","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-iceberg/src/main/java/org/apache/seatunnel/connectors/seatunnel/iceberg/IcebergCatalogLoader.java#L142-L178","documentation":"This warning is raised by IcebergCatalogLoader.doKerberosAuthentication() when either the Kerberos principal or the keytab path is blank. Instead of attempting a (guaranteed-to-fail) login, the method skips Kerberos entirely and logs which fields were empty; the Hadoop configuration is left non-kerberized, so access to secured resources will likely fail later with permission errors.","triggerScenarios":"doKerberosAuthentication(configuration, principal, keytabPath) is called (from doKerberosLogin) with an empty/whitespace principal or keytabPath; StringUtils.isBlank catches it and logs this warning instead of setting hadoop.security.authentication=kerberos.","commonSituations":"Only one of principal/keytab configured (the other forgotten or misnamed option so it resolves to null/empty); empty-string options in HOCON config; env-var-driven configs where the variable was not substituted.","solutions":["Set BOTH the Kerberos principal and keytab path options to non-empty values in the Iceberg catalog/sink config.","Verify the option keys are the ones the connector reads (a typo yields blank values silently); print/log the resolved values to confirm.","If Kerberos is not required, explicitly leave both unset so the skip is intentional rather than an accident."],"exampleFix":"// before\nkerberos_principal = \"user@EXAMPLE.COM\"\n# keytab missing -> skip warning\n// after\nkerberos_principal = \"user@EXAMPLE.COM\"\nkerberos_keytab_path = \"/etc/security/keytabs/user.keytab\"","handlingStrategy":"validation","validationCode":"if (principal == null || principal.isBlank() || keytabPath == null || keytabPath.isBlank()) {\n    throw new IllegalArgumentException(\"Both kerberos principal and keytabPath must be non-empty for Kerberos auth\");\n}\nif (!Files.isReadable(Paths.get(keytabPath))) throw new IllegalArgumentException(\"keytab not readable: \" + keytabPath);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set principal AND keytab path together; a typo in either key silently yields blank values","Check file existence/readability of the keytab before submitting the job","Interpolate env vars carefully — unresolved variables become empty strings","If Kerberos is not needed, leave both options unset deliberately"],"tags":["kerberos","iceberg","authentication","config"],"backgroundTag":"missing-credentials","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}