Kerberos JAAS config contains no Krb5LoginModule

Error message

Kerberos JAAS config contains no Krb5LoginModule

What it means

When parsing a JAAS config file for Kerberos options, the driver scans for the string 'krb5loginmodule' (case-insensitive). If the file does not contain that login module, it cannot extract principal/keytab/ticket-cache options and fails with this error. The JAAS file exists but is not a Kerberos login configuration.

Source

Thrown at agents/drivers/hive-go/config.go:969

	}
	kerberos.Realm = firstNonEmpty(kerberos.Realm, realmFromPrincipal(kerberos.ClientPrincipal))
	if !kerberos.UseTicketCache && !kerberos.UseKeytab && (kerberos.ClientPrincipal == "" || kerberos.Password == "") {
		return errors.New("Kerberos requires SSPI, credential cache, keytab, or principal and password")
	}
	return nil
}

var jaasOptionPattern = regexp.MustCompile(`(?i)\b(principal|keytab|ticketcache|usekeytab|useticketcache)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|[^\s;]+)`)

func applyKerberosJAASFile(config *kerberosConfig) error {
	contents, err := os.ReadFile(config.JAASConfigPath)
	if err != nil {
		return fmt.Errorf("read Kerberos JAAS config: %w", err)
	}
	text := string(contents)
	module := strings.Index(strings.ToLower(text), "krb5loginmodule")
	if module < 0 {
		return errors.New("Kerberos JAAS config contains no Krb5LoginModule")
	}
	block := text[module:]
	if end := strings.IndexByte(block, ';'); end >= 0 {
		block = block[:end]
	}
	for _, match := range jaasOptionPattern.FindAllStringSubmatch(block, -1) {
		key := strings.ToLower(match[1])
		value := decodeJAASValue(match[2])
		switch key {
		case "principal":
			if config.ClientPrincipal == "" {
				config.ClientPrincipal = value
			}
		case "keytab":
			if config.KeytabPath == "" {
				config.KeytabPath = value
			}
		case "ticketcache":

View on GitHub (pinned to c0390bff16)

Solutions

Add a com.sun.security.auth.module.Krb5LoginModule entry to the JAAS file.
Point the JAAS config path at the correct file containing a Krb5LoginModule stanza.
Fix any typos in the module class name (must contain 'krb5loginmodule' case-insensitively).

Example fix

// before
otherModule { com.example.OtherModule required; };
// after
hiveClient { com.sun.security.auth.module.Krb5LoginModule required principal="hive@EXAMPLE.COM" useKeyTab=true keyTab="/etc/security/hive.keytab"; };

Defensive patterns

Strategy: validation

Validate before calling

contents, err := os.ReadFile(jaasPath)
if err != nil { return err }
if !strings.Contains(strings.ToLower(string(contents)), "krb5loginmodule") {
	return fmt.Errorf("%s has no Krb5LoginModule", jaasPath)
}

Prevention

Verify JAAS files contain com.sun.security.auth.module.Krb5LoginModule before deployment
Do not reuse JAAS files across different subsystems (Kafka, HDFS, Hive)
Add a startup smoke test that parses the JAAS file

When it happens

Trigger: Pointing the Kerberos JAAS config path at a JAAS file whose stanza uses another LoginModule (e.g. Krb5InitCredential, com.sun.security.auth.module other module, LDAP or plain login modules), or a file missing the module entry entirely.

Common situations: Reusing a JAAS file intended for Kafka/HDFS with different modules; hand-written JAAS file with a typo like 'Krb5LoginModul'; pointing at the wrong file (e.g. log4j or another config).

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/ad147552532352c7. Report an issue: GitHub.