{"record":{"id":"f26617229bfe3c09","repo":"prestodb/presto","slug":"kerberos-error-for-s-s","errorCode":null,"errorMessage":"Kerberos error for [%s]: %s","messagePattern":"Kerberos error for \\[(.+?)\\]: (.+?)","errorType":"exception","errorClass":"ClientException","httpStatus":null,"severity":"error","filePath":"presto-client/src/main/java/com/facebook/presto/client/SpnegoHandler.java","lineNumber":171,"sourceCode":"                        SPNEGO_OID,\n                        session.getClientCredential(),\n                        INDEFINITE_LIFETIME);\n\n                result.requestMutualAuth(true);\n                result.requestConf(true);\n                result.requestInteg(true);\n                result.requestCredDeleg(false);\n                return result;\n            });\n\n            byte[] token = context.initSecContext(new byte[0], 0, 0);\n            if (token == null) {\n                throw new LoginException(\"No token generated from GSS context\");\n            }\n            return token;\n        }\n        catch (GSSException | LoginException e) {\n            throw new ClientException(format(\"Kerberos error for [%s]: %s\", servicePrincipal, e.getMessage()), e);\n        }\n        finally {\n            try {\n                if (context != null) {\n                    context.dispose();\n                }\n            }\n            catch (GSSException ignored) {\n            }\n        }\n    }\n\n    private synchronized Session getSession()\n            throws LoginException, GSSException\n    {\n        if ((clientSession == null) || clientSession.needsRefresh()) {\n            clientSession = createSession();\n        }","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-client/src/main/java/com/facebook/presto/client/SpnegoHandler.java#L153-L189","documentation":"SpnegoHandler.generateToken performs Kerberos login and GSS context initiation to produce a SPNEGO token; any GSSException or LoginException is wrapped in a ClientException formatted as 'Kerberos error for [principal]: <detail>'. It means Kerberos authentication for the given servicePrincipal failed — bad credentials, no valid ticket, or a GSS-level protocol error.","triggerScenarios":"Calling SpnegoHandler.token() with Kerberos authentication enabled when the JAAS login fails (missing keytab/bad principal) or GSSContext.initSecContext fails (no KDC reachable, unsupported mech, clock skew).","commonSituations":"Missing or unreadable keytab file; wrong krb5.conf; principal not in KDC; expired TGT; ticket cache absent (no kinit) in headless environments; KDC unreachable from the client host.","solutions":["Run klist to confirm a valid ticket exists; kinit with the correct principal/keytab if not.","Verify the Kerberos config: KDC addresses and realm in /etc/krb5.conf, and that the KDC is reachable.","Confirm the keytab file exists and is readable, and the principal matches exactly (case-sensitive realm/host).","Set -Dsun.security.krb5.debug=true and -Djava.security.auth.login.config pointing at the JAAS config to debug.","Check clock skew between client and KDC (Kerberos tolerates ~5 minutes)."],"exampleFix":"// before\n// client starts with no credential cache\n// after\nkinit -kt /etc/presto/presto.keytab presto-client@EXAMPLE.COM\njava -Djava.security.auth.login.config=jaas.conf -Dsun.security.krb5.debug=true ...","handlingStrategy":"try-catch","validationCode":"Process p = new ProcessBuilder(\"klist\", \"-k\", keytabPath).start();\nif (p.waitFor() != 0) throw new IllegalStateException(\"Keytab/principal missing or unreadable\");","typeGuard":null,"tryCatchPattern":"try { StatementClient client = ...; } catch (ClientException e) { if (e.getMessage().startsWith(\"Kerberos error\")) { /* re-kinit, check krb5.conf, then retry once */ } throw e; }","preventionTips":["kinit or use keytab-based JAAS login before starting the client","Validate krb5.conf and KDC reachability (kinit test)","Keep keytab file permissions correct (readable by service user)","Monitor ticket expiry in long-running processes"],"tags":["kerberos","spnego","authentication"],"backgroundTag":"kerberos-authentication-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}