Skip to main content

Resolve Kerberos LoginException in Solr Data Import Handler

Updated

Issue

When attempting to run a Data Import Handler (DIH) job using a JDBC connection to Microsoft SQL Server via Kerberos authentication, the database connection fails. The Solr logs or DIH output display an error stack trace containing the following exception:

com.microsoft.sqlserver.jdbc.SQLServerException: Kerberos Login failed: Integrated authentication failed.
...
Caused by: javax.security.auth.login.LoginException: Cannot get any of properties: [user, USER] from con properties not available to garner authentication information from the user

 

Diagnosis

The JDBC driver running inside the Solr Java Virtual Machine (JVM) is unable to locate a valid Kerberos ticket or principal. To confirm the JVM behavior and identify the specific ticket cache it is attempting to read, enable Java Kerberos debugging.

Add the following parameters to the SOLR_OPTS variable in the solr.in.sh configuration file:

-Dsun.security.krb5.debug=true -Dsun.security.spnego.debug=true -Djava.security.debug=gssloginconfig,logincontext,configfile

Restart the Solr service and rerun the DIH job. Inspect the Solr console logs or standard output for messages indicating the ticket cache location:

>>>KinitOptions cache name is /tmp/krb5cc_1077405673
[LoginContext]: login REQUIRED failure

Verify if the identified cache file exists, who owns it, and if the Solr service user has permissions to read it:

ls -l /tmp/krb5cc_1077405673

 

Environment

  • Solr

  • Data Import Handler (DIH)

  • Microsoft SQL Server JDBC Driver

  • Kerberos Authentication

 

Cause

The Kerberos ticket cache was generated by a different system user, frequently the root user, rather than the dedicated service user running the Solr process. The Solr JVM cannot access a Kerberos ticket cache generated under a different user context, causing the authentication process to fail when initializing the JDBC database connection.

 

Resolution

The ticket cache must be generated explicitly as the user running the Solr service.

Generate a fresh ticket using the keytab while executing the command as the Solr user. Replace the principal and realm with the appropriate values for the environment:

sudo -u solr kinit -kt /path/to/solr.keytab principal@REALM.COM

Verify that the ticket cache is now correctly populated and accessible for the Solr user:

sudo -u solr klist

Run the Data Import Handler job again to confirm the database connection succeeds.

Powered by Zendesk