juicedata/juicefs · error · IllegalArgumentException

No kerberos credential was found! Parameter "--keytab" and "

Error message

No kerberos credential was found! Parameter "--keytab" and "--principal" must be provided.

What it means

RangerDownloader.run requires Kerberos credentials to authenticate to Ranger/Hadoop before downloading; if the current UGI has no Kerberos credentials and either --keytab or --principal is missing, it throws this IllegalArgumentException.

Source

Thrown at sdk/java/src/main/java/io/juicefs/tools/RangerDownloader.java:50

  @Parameter(names = {"--fs"}, description = "JuiceFileSystem: jfs://{JFS_VOL_NAME}", required = true)
  private String fs;

  @Parameter(names = {"--keytab"}, description = "local keytab file location")
  private String keytab;

  @Parameter(names = {"--principal"}, description = "principal allowed access ranger admin")
  private String principal;

  @Override
  public void init() throws IOException {

  }

  @Override
  public void run() throws IOException {
    UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
    if (!ugi.hasKerberosCredentials() && (keytab == null || principal == null)) {
      throw new IllegalArgumentException("No kerberos credential was found! Parameter \"--keytab\" and \"--principal\" must be provided.");
    }
    if (keytab != null) {
      UserGroupInformation.loginUserFromKeytab(principal, keytab);
    }
    Configuration cfg = new Configuration();
    JuiceFileSystemImpl jfs = new JuiceFileSystemImpl(true);
    jfs.initialize(URI.create(fs), cfg);
    new RangerPermissionChecker(jfs, jfs.checkAndGetRangerParams(cfg));
  }

  @Override
  public void close() throws IOException {

  }

  @Override
  public String getCommand() {
    return "ranger";

View on GitHub (pinned to c9a67b23e8)

Solutions

Pass both --keytab <path> and --principal <user@REALM> to the tool
Run `kinit` (or use a ticket cache) before invoking so UGI has Kerberos credentials
Set HADOOP_KERBEROS settings / ensure core-site.xml default names are correct
Wrap invocation in a script that validates the ticket cache with `klist -s`

Example fix

// before
java -cp ... io.juicefs.tools.RangerDownloader
// after
java -cp ... io.juicefs.tools.RangerDownloader --keytab /etc/security/keytabs/jfs.keytab --principal jfs@EXAMPLE.COM

Defensive patterns

Strategy: validation

Validate before calling

UserGroupInformation ugi = UserGroupInformation.getCurrentUser();
if (!ugi.hasKerberosCredentials() && (keytab == null || principal == null)) {
  throw new IllegalArgumentException("Provide --keytab and --principal or kinit first");
}

Try / catch

try {
  downloader.run();
} catch (IllegalArgumentException e) {
  if (e.getMessage().contains("No kerberos credential was found")) {
    LOG.error("Run kinit or pass --keytab/--principal");
  } else throw e;
}

Prevention

Always pass --keytab and --principal in automation
Validate ticket cache (klist -s) before launching the tool
Use keytab login for headless/service accounts

When it happens

Trigger: Running the RangerDownloader tool (from main) without passing both --keytab and --principal, and without an existing Kerberos login (kinit) in the process.

Common situations: Forgetting CLI flags in cron/automation; assuming a kinit'ed TGT exists on service accounts; headless environments with no ticket cache.

Related errors

AI-assisted analysis of juicedata/juicefs@c9a67b23e8 (2026-09-06). Data as JSON: /api/errors/95f9e57eab506aad. Report an issue: GitHub.