apache / apache/pulsar

Kerberos authentication failed

Open
#12,587 4 comments 0 reactions 0 assignees View on GitHub
type/bug
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

**Describe the bug**

Configure kerberos according to this documentation https://pulsar.apache.org/docs/en/security-kerberos/, throwing exceptions

```
Exception: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
org.apache.pulsar.client.admin.PulsarAdminException: java.util.concurrent.ExecutionException: org.apache.pulsar.client.admin.PulsarAdminException$GettingAuthenticationDataException: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at org.apache.pulsar.client.admin.internal.BaseResource.getApiException(BaseResource.java:247) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.TenantsImpl$1.failed(TenantsImpl.java:72) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:167) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.TenantsImpl.getTenantsAsync(TenantsImpl.java:63) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.TenantsImpl.getTenants(TenantsImpl.java:49) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.PulsarStandalone.createNameSpace(PulsarStandalone.java:361) [org.apache.pulsar-pulsar-broker-2.8.1.jar:2.8.1]
at org.apache.pulsar.PulsarStandalone.start(PulsarStandalone.java:349) [org.apache.pulsar-pulsar-broker-2.8.1.jar:2.8.1]
at org.apache.pulsar.PulsarStandaloneStarter.main(PulsarStandaloneStarter.java:121) [org.apache.pulsar-pulsar-broker-2.8.1.jar:2.8.1]
Caused by: java.util.concurrent.ExecutionException: org.apache.pulsar.client.admin.PulsarAdminException$GettingAuthenticationDataException: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:357) ~[?:1.8.0_292]
at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1908) ~[?:1.8.0_292]
at org.apache.pulsar.client.admin.internal.BaseResource.request(BaseResource.java:68) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:165) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
... 5 more
Caused by: org.apache.pulsar.client.admin.PulsarAdminException$GettingAuthenticationDataException: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at org.apache.pulsar.client.admin.internal.BaseResource.requestAsync(BaseResource.java:111) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.request(BaseResource.java:68) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:165) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
... 5 more
Caused by: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at org.apache.pulsar.client.impl.auth.PulsarSaslClient.evaluateChallenge(PulsarSaslClient.java:116) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.SaslAuthenticationDataProvider.authenticate(SaslAuthenticationDataProvider.java:55) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.newRequestHeader(AuthenticationSasl.java:264) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.newRequestBuilder(AuthenticationSasl.java:198) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.authenticationStage(AuthenticationSasl.java:307) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.requestAsync(BaseResource.java:82) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.request(BaseResource.java:68) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:165) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
... 5 more
```

**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

**Expected behavior**
A clear and concise description of what you expected to happen.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**
- OS: [e.g. iOS]

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Review the Kerberos configuration linked in the issue and start at PulsarSaslClient.evaluateChallenge, then follow the PulsarStandalone startup path shown in the stack trace. Establish a minimal reproducible configuration for the Server not found in Kerberos database error. Done means the reproduction is explained and admin authentication succeeds or the documented configuration is corrected.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.