spring-projects/spring-security · error · BadCredentialsException

Kerberos authentication failed

Error message

Kerberos authentication failed

What it means

SunJaasKerberosClient.login() wraps any javax.security.auth.login.LoginException thrown by the JAAS LoginContext into a BadCredentialsException with this message. It means the JAAS Kerberos login module (Krb5LoginModule) could not authenticate the configured principal, e.g. wrong password, missing keytab, bad realm, or unreachable KDC.

Source

Thrown at kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/SunJaasKerberosClient.java:82

					new KerberosClientCallbackHandler(username, password), new LoginConfig(this.debug));
			loginContext.login();

			Subject jaasSubject = loginContext.getSubject();

			if (LOG.isDebugEnabled()) {
				LOG.debug("Kerberos authenticated user: " + jaasSubject);
			}

			String validatedUsername = jaasSubject.getPrincipals().iterator().next().toString();
			Subject subjectCopy = JaasUtil.copySubject(jaasSubject);
			result = new JaasSubjectHolder(subjectCopy, validatedUsername);

			if (!this.multiTier) {
				loginContext.logout();
			}
		}
		catch (LoginException ex) {
			throw new BadCredentialsException("Kerberos authentication failed", ex);
		}

		return result;
	}

	public void setDebug(boolean debug) {
		this.debug = debug;
	}

	public void setMultiTier(boolean multiTier) {
		this.multiTier = multiTier;
	}

	private static final class LoginConfig extends Configuration {

		private boolean debug;

		private LoginConfig(boolean debug) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Verify /etc/krb5.conf points at the correct realm and KDC and that 'kinit <principal>' succeeds on the host.
2. Enable JAAS debug (setDebug(true) on SunJaasKerberosClient) and inspect the underlying LoginException cause for the real reason.
3. If using a keytab, regenerate it with kadmin/ktpass and confirm the KVNO matches the KDC; ensure the file is readable by the JVM user.
4. Check clock synchronization (NTP) between the application host and the KDC; Kerberos tolerates only ~5 minutes skew.
5. Confirm the JAAS config file referenced by java.security.auth.login.config contains the correct Krb5LoginModule options.

Example fix

// before
SunJaasKerberosClient client = new SunJaasKerberosClient();
client.setPrincipal("HTTP/host@WRONG.REALM");
Authentication auth = client.login(); // LoginException -> BadCredentialsException

// after
client.setDebug(true); // diagnose root cause
client.setPrincipal("HTTP/host.example.com@CORRECT.REALM");
System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");
Authentication auth = client.login();

// before login()
if (!new File("/etc/krb5.conf").exists()) throw new IllegalStateException("krb5.conf missing");
Process k = new ProcessBuilder("klist", "-k").start(); // verify keytab lists principal
if (k.waitFor() != 0) throw new IllegalStateException("keytab unreadable");

boolean isPrincipalConfigured(SunJaasKerberosClient c) {
    return c != null && c.getPrincipal() != null && c.getPrincipal().contains("@");
}

try {
    auth = client.login();
} catch (BadCredentialsException e) {
    LOGGER.warn("Kerberos login failed: {}", e.getCause() != null ? e.getCause().toString() : e.getMessage());
    throw new AuthenticationServiceException("kerberos login unavailable", e);
}

When it happens

Trigger: Calling SunJaasKerberosClient.login() with credentials the KDC rejects, a loginContext.login() failure due to a missing/invalid JAAS config or krb5.conf, or an expired/invalid keytab entry; the LoginException is caught in login() and rethrown as BadCredentialsException.

Common situations: Misconfigured krb5.conf (wrong default_realm or kdc host), keytab file missing or with stale key version numbers (KVNO mismatch), clock skew beyond the allowed skew between client and KDC, or principal name misspelled in the JAAS login config.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unknown Callback
• RunAsImplAuthenticationProvider.incorrectKey
• Authenticated principal required to operate with ACLs
• CasAuthenticationProvider.incorrectKey
• oidc_provider_not_configured

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/eba679a507a6f763. Report an issue: GitHub.