{"record":{"id":"f3cebb678a1ca24c","repo":"apache/dolphinscheduler","slug":"createusergroupinformation-fail","errorCode":null,"errorMessage":"createUserGroupInformation fail. ","messagePattern":"createUserGroupInformation fail\\. ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-datasource-plugin/dolphinscheduler-datasource-hive/src/main/java/org/apache/dolphinscheduler/plugin/datasource/hive/security/UserGroupInformationFactory.java","lineNumber":116,"sourceCode":"        String krb5File = PropertyUtils.getString(Constants.JAVA_SECURITY_KRB5_CONF_PATH);\n        String keytab = PropertyUtils.getString(Constants.LOGIN_USER_KEY_TAB_PATH);\n        String principal = PropertyUtils.getString(Constants.LOGIN_USER_KEY_TAB_USERNAME);\n        if (StringUtils.isNotBlank(krb5File)) {\n            System.setProperty(Constants.JAVA_SECURITY_KRB5_CONF, krb5File);\n        }\n\n        Configuration hadoopConf = new Configuration();\n        hadoopConf.setBoolean(\"ipc.client.fallback-to-simple-auth-allowed\", true);\n        hadoopConf.set(Constants.HADOOP_SECURITY_AUTHENTICATION, Constants.KERBEROS);\n\n        try {\n            UserGroupInformation.setConfiguration(hadoopConf);\n            UserGroupInformation userGroupInformation =\n                    UserGroupInformation.loginUserFromKeytabAndReturnUGI(principal.trim(), keytab.trim());\n            UserGroupInformation.setLoginUser(userGroupInformation);\n            return userGroupInformation;\n        } catch (IOException e) {\n            throw new RuntimeException(\"createUserGroupInformation fail. \", e);\n        }\n    }\n\n    public static boolean openKerberos() {\n        String resUploadStartupType = PropertyUtils.getUpperCaseString(Constants.RESOURCE_STORAGE_TYPE);\n        StorageType storageType = StorageType.valueOf(resUploadStartupType);\n        Boolean kerberosStartupState =\n                PropertyUtils.getBoolean(Constants.HADOOP_SECURITY_AUTHENTICATION_STARTUP_STATE, false);\n        return storageType == StorageType.HDFS && kerberosStartupState;\n    }\n\n}\n","sourceCodeStart":98,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-datasource-plugin/dolphinscheduler-datasource-hive/src/main/java/org/apache/dolphinscheduler/plugin/datasource/hive/security/UserGroupInformationFactory.java#L98-L129","documentation":"UserGroupInformationFactory.createKerberosUser wraps IOException from UserGroupInformation.loginUserFromKeytabAndReturnUGI in a RuntimeException. It means Kerberos login with the given principal and keytab failed — typically bad credentials, unreadable keytab, clock skew, or KDC/realm misconfiguration.","triggerScenarios":"login -> createKerberosUser when principal/keytab are wrong, keytab file does not exist or is unreadable, encryption types are unsupported, KDC is unreachable, or realm/defaultRealm mismatch causes authentication failure.","commonSituations":"Wrong principal name (case-sensitive, must match keytab entries); keytab path typo or missing file on worker nodes; expired keytab; kinit works interactively but service user lacks read permission on keytab; krb5.conf missing realms; clock skew > 5 min vs KDC.","solutions":["Inspect the wrapped IOException cause for the exact kinit-style failure (e.g. 'Unable to obtain password from user', 'Clock skew too great')","Verify principal and keytab path in the datasource form/config: test with `klist -kt keytab` and `kinit -kt keytab principal` on the worker host as the same OS user","Ensure the keytab file exists and is readable by the dolphinScheduler daemon user on every worker","Align krb5.conf realms/KDC and Hadoop hadoop.security.authentication=kerberos configuration; check NTP/clock sync","Regenerate keytab with supported encryption types (aes-256 etc.) if the KDC/types mismatch"],"exampleFix":"// before\nprincipal: hive/_HOST@EXAMPLE.COM\nkeytab: /opt/keytab/hive.keytab   // file missing on worker\n// after\nklist -kt /etc/security/keytabs/hive.service.keytab\nprincipal: hive/master@EXAMPLE.COM\nkeytab: /etc/security/keytabs/hive.service.keytab  // exists & readable by ds user","handlingStrategy":"try-catch","validationCode":"if (!new File(keytab).canRead()) throw new IllegalArgumentException(\"keytab unreadable: \" + keytab);\nif (principal == null || !principal.contains(\"@\")) throw new IllegalArgumentException(\"bad principal: \" + principal);\nRuntime.getRuntime().exec(new String[]{\"klist\",\"-kt\",keytab}).waitFor();","typeGuard":null,"tryCatchPattern":"try {\n  ugi = UserGroupInformationFactory.createKerberosUser(hadoopConf, principal, keytab);\n} catch (RuntimeException e) {\n  if (e.getMessage() != null && e.getMessage().startsWith(\"createUserGroupInformation fail\")) {\n    log.error(\"Kerberos login failed for {} — verify keytab/principal/KDC\", principal, e.getCause());\n  } else throw e;\n}","preventionTips":["Test credentials with kinit -kt on the worker as the DS OS user","Keep keytab permissions readable only by the daemon user but not blocked","Sync clocks with KDC via NTP","Regenerate keytabs before expiry and align encryption types with krb5.conf"],"tags":["kerberos","authentication","hive","keytab"],"backgroundTag":"kerberos-authentication-failed","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}