{"record":{"id":"ef9ac58590ffda35","repo":"apache/hadoop","slug":"server-has-invalid-kerberos-principal-s-expecti","errorCode":null,"errorMessage":"Server has invalid Kerberos principal: %s, expecting: %s","messagePattern":"Server has invalid Kerberos principal: (.+?), expecting: (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java","lineNumber":351,"sourceCode":"      // check that the server advertised principal matches our conf\n      String confPrincipal = SecurityUtil.getServerPrincipal(\n          conf.get(serverKey), serverAddr.getAddress());\n      if (LOG.isDebugEnabled()) {\n        LOG.debug(\"getting serverKey: \" + serverKey + \" conf value: \" + conf.get(serverKey)\n            + \" principal: \" + confPrincipal);\n      }\n      if (confPrincipal == null || confPrincipal.isEmpty()) {\n        throw new IllegalArgumentException(\n            \"Failed to specify server's Kerberos principal name\");\n      }\n      KerberosName name = new KerberosName(confPrincipal);\n      if (name.getHostName() == null) {\n        throw new IllegalArgumentException(\n            \"Kerberos principal name does NOT have the expected hostname part: \"\n                + confPrincipal);\n      }\n      if (!serverPrincipal.equals(confPrincipal)) {\n        throw new IllegalArgumentException(String.format(\n            \"Server has invalid Kerberos principal: %s, expecting: %s\",\n            serverPrincipal, confPrincipal));\n      }\n    }\n    return serverPrincipal;\n  }\n\n  /**\n   * Do client side SASL authentication with server via the given IpcStreams.\n   *\n   * @param ipcStreams ipcStreams.\n   * @return AuthMethod used to negotiate the connection\n   * @throws IOException raised on errors performing I/O.\n   */\n  public AuthMethod saslConnect(IpcStreams ipcStreams) throws IOException {\n    // redefined if/when a SASL negotiation starts, can be queried if the\n    // negotiation fails\n    authMethod = AuthMethod.SIMPLE;","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java#L333-L369","documentation":"Error \"Server has invalid Kerberos principal: %s, expecting: %s\" thrown in apache/hadoop.","triggerScenarios":"Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/SaslRpcClient.java:351 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the server to use the expected Kerberos principal; the presented principal does not match what the client expects.","Verify the keytab contains the expected principal and the service config references it.","Check DNS so both client and server agree on the service hostname used in the principal."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}