juicedata/juicefs · error · IOException

generate kerberos AP-REQ failed

Error message

generate kerberos  AP-REQ failed

What it means

Thrown in buildAuthCredential when the client, configured with a Kerberos service principal name, fails to generate the AP-REQ token needed for the initial JuiceFS authentication handshake. It means the JVM Kerberos setup could not produce a service ticket for the given SPN (missing TGT, wrong principal, or clock/KDC problems).

Source

Thrown at sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java:2351

    try {
      Class<AclStatus.Builder> ab = AclStatus.Builder.class;
      Method abm = ab.getDeclaredMethod("setPermission", FsPermission.class);
      abm.setAccessible(true);
      abm.invoke(builder, st.getPermission());
    } catch (NoSuchMethodException | IllegalAccessException | InvocationTargetException ignored) {
    }
    return builder.build();
  }

  public AuthCredential buildAuthCredential(String spn) throws IOException {
    // auth use kerberos, only when the server principal is configured
    if (spn != null && !spn.isEmpty() && UserGroupInformation.getLoginUser().hasKerberosCredentials()) {
      dtEnabled = true;
      byte[] cred;
      try {
        cred = KerberosUtil.genApReq(spn);
      } catch (InterruptedException e) {
        throw new IOException("generate kerberos  AP-REQ failed", e);
      }
      return new AuthCredential("kerberos", cred);
    }

    // auth use delegation token
    for (Token<? extends TokenIdentifier> token : ugi.getCredentials().getAllTokens()) {
      if (token.getKind().equals(JuiceFSDelegationTokenIdentifier.TOKEN_KIND) &&
          buildServiceName().equals(token.getService().toString())) {
        dtEnabled = true;

        AbstractDelegationTokenIdentifier identifier = (AbstractDelegationTokenIdentifier) token.decodeIdentifier();
        int id = identifier.getMasterKeyId();
        byte[] password = token.getPassword();
        ByteBuffer buf = ByteBuffer.allocate(8 + password.length);
        buf.putInt(id);
        buf.putInt(password.length);
        buf.put(password);

View on GitHub (pinned to c9a67b23e8)

Solutions

1. Verify kinit was performed and a valid TGT exists for the login user
2. Check that the configured service principal (juicefs.metadata-service-principal) matches the KDC principal exactly, including realm

When it happens

Trigger: Thrown at sdk/java/src/main/java/io/juicefs/JuiceFileSystemImpl.java:2351 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/25daa22a58961d6a. Report an issue: GitHub.