Kerberos authentication failed
- Dominant language
- Java
- Stars
- 15.3k
- Forks
- 3.8k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 160
Description
**Describe the bug**
Configure kerberos according to this documentation https://pulsar.apache.org/docs/en/security-kerberos/, throwing exceptions
```
Exception: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
org.apache.pulsar.client.admin.PulsarAdminException: java.util.concurrent.ExecutionException: org.apache.pulsar.client.admin.PulsarAdminException$GettingAuthenticationDataException: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at org.apache.pulsar.client.admin.internal.BaseResource.getApiException(BaseResource.java:247) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.TenantsImpl$1.failed(TenantsImpl.java:72) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:167) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.TenantsImpl.getTenantsAsync(TenantsImpl.java:63) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.TenantsImpl.getTenants(TenantsImpl.java:49) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.PulsarStandalone.createNameSpace(PulsarStandalone.java:361) [org.apache.pulsar-pulsar-broker-2.8.1.jar:2.8.1]
at org.apache.pulsar.PulsarStandalone.start(PulsarStandalone.java:349) [org.apache.pulsar-pulsar-broker-2.8.1.jar:2.8.1]
at org.apache.pulsar.PulsarStandaloneStarter.main(PulsarStandaloneStarter.java:121) [org.apache.pulsar-pulsar-broker-2.8.1.jar:2.8.1]
Caused by: java.util.concurrent.ExecutionException: org.apache.pulsar.client.admin.PulsarAdminException$GettingAuthenticationDataException: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:357) ~[?:1.8.0_292]
at java.util.concurrent.CompletableFuture.get(CompletableFuture.java:1908) ~[?:1.8.0_292]
at org.apache.pulsar.client.admin.internal.BaseResource.request(BaseResource.java:68) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:165) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
... 5 more
Caused by: org.apache.pulsar.client.admin.PulsarAdminException$GettingAuthenticationDataException: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at org.apache.pulsar.client.admin.internal.BaseResource.requestAsync(BaseResource.java:111) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.request(BaseResource.java:68) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:165) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
... 5 more
Caused by: javax.naming.AuthenticationException: SASL/JAAS errorjavax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)]
at org.apache.pulsar.client.impl.auth.PulsarSaslClient.evaluateChallenge(PulsarSaslClient.java:116) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.SaslAuthenticationDataProvider.authenticate(SaslAuthenticationDataProvider.java:55) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.newRequestHeader(AuthenticationSasl.java:264) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.newRequestBuilder(AuthenticationSasl.java:198) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.impl.auth.AuthenticationSasl.authenticationStage(AuthenticationSasl.java:307) ~[org.apache.pulsar-pulsar-client-auth-sasl-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.requestAsync(BaseResource.java:82) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.request(BaseResource.java:68) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
at org.apache.pulsar.client.admin.internal.BaseResource.asyncGetRequest(BaseResource.java:165) ~[org.apache.pulsar-pulsar-client-admin-original-2.8.1.jar:2.8.1]
... 5 more
```
**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Desktop (please complete the following information):**
- OS: [e.g. iOS]
**Additional context**
Add any other context about the problem here.
Contributor guide
Research direction
Review the Kerberos configuration linked in the issue and start at PulsarSaslClient.evaluateChallenge, then follow the PulsarStandalone startup path shown in the stack trace. Establish a minimal reproducible configuration for the Server not found in Kerberos database error. Done means the reproduction is explained and admin authentication succeeds or the documented configuration is corrected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100