prestodb/presto · error · ClientException

Kerberos error for [%s]: %s

Error message

Kerberos error for [%s]: %s

What it means

SpnegoHandler.generateToken performs Kerberos login and GSS context initiation to produce a SPNEGO token; any GSSException or LoginException is wrapped in a ClientException formatted as 'Kerberos error for [principal]: <detail>'. It means Kerberos authentication for the given servicePrincipal failed — bad credentials, no valid ticket, or a GSS-level protocol error.

Source

Thrown at presto-client/src/main/java/com/facebook/presto/client/SpnegoHandler.java:171

                        SPNEGO_OID,
                        session.getClientCredential(),
                        INDEFINITE_LIFETIME);

                result.requestMutualAuth(true);
                result.requestConf(true);
                result.requestInteg(true);
                result.requestCredDeleg(false);
                return result;
            });

            byte[] token = context.initSecContext(new byte[0], 0, 0);
            if (token == null) {
                throw new LoginException("No token generated from GSS context");
            }
            return token;
        }
        catch (GSSException | LoginException e) {
            throw new ClientException(format("Kerberos error for [%s]: %s", servicePrincipal, e.getMessage()), e);
        }
        finally {
            try {
                if (context != null) {
                    context.dispose();
                }
            }
            catch (GSSException ignored) {
            }
        }
    }

    private synchronized Session getSession()
            throws LoginException, GSSException
    {
        if ((clientSession == null) || clientSession.needsRefresh()) {
            clientSession = createSession();
        }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Run klist to confirm a valid ticket exists; kinit with the correct principal/keytab if not.
2. Verify the Kerberos config: KDC addresses and realm in /etc/krb5.conf, and that the KDC is reachable.
3. Confirm the keytab file exists and is readable, and the principal matches exactly (case-sensitive realm/host).
4. Set -Dsun.security.krb5.debug=true and -Djava.security.auth.login.config pointing at the JAAS config to debug.
5. Check clock skew between client and KDC (Kerberos tolerates ~5 minutes).

Example fix

// before
// client starts with no credential cache
// after
kinit -kt /etc/presto/presto.keytab presto-client@EXAMPLE.COM
java -Djava.security.auth.login.config=jaas.conf -Dsun.security.krb5.debug=true ...

Process p = new ProcessBuilder("klist", "-k", keytabPath).start();
if (p.waitFor() != 0) throw new IllegalStateException("Keytab/principal missing or unreadable");

try { StatementClient client = ...; } catch (ClientException e) { if (e.getMessage().startsWith("Kerberos error")) { /* re-kinit, check krb5.conf, then retry once */ } throw e; }

When it happens

Trigger: Calling SpnegoHandler.token() with Kerberos authentication enabled when the JAAS login fails (missing keytab/bad principal) or GSSContext.initSecContext fails (no KDC reachable, unsupported mech, clock skew).

Common situations: Missing or unreadable keytab file; wrong krb5.conf; principal not in KDC; expired TGT; ticket cache absent (no kinit) in headless environments; KDC unreachable from the client host.

Related errors

• Fully qualified name of localhost should not resolve to 'loc
• Authentication using Kerberos requires SSL to be enabled
• UNEXPECTED_ACCUMULO_ERROR
• UNEXPECTED_ACCUMULO_ERROR
• Failed to create Credentials from key

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/f26617229bfe3c09. Report an issue: GitHub.