Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Kerberos:Error occured in generating credentials

avatar
Expert Contributor

Hi,

 

I was enabling kerberos from cloudera manager.

Everything worked fine but when it tried to do the step of "generating Credentials" it gave me an error.

Please find the error.

 

Any suggestions?

Waiting for the reply

 

 

/usr/share/cmf/bin/gen_credentials.sh failed with exit code 1 and output of <<
+ export PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/sbin:/usr/sbin:/bin:/usr/bin
+ PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/sbin:/usr/sbin:/bin:/usr/bin
+ CMF_REALM=JNJ.COM
+ KEYTAB_OUT=/var/run/cloudera-scm-server/cmf7829892990940630057.keytab
+ PRINC=impala/itsusmpl00509.jnj.com@JNJ.COM
+ MAX_RENEW_LIFE=432000
+ KADMIN='kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/admin@JNJ.COM -r JNJ.COM'
+ RENEW_ARG=
+ '[' 432000 -gt 0 ']'
+ RENEW_ARG='-maxrenewlife "432000 sec"'
+ kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/admin@JNJ.COM -r JNJ.COM -q 'addprinc -maxrenewlife "432000 sec" -randkey impala/itsusmpl00509.jnj.com@JNJ.COM'
WARNING: no policy specified for impala/itsusmpl00509.jnj.com@JNJ.COM; defaulting to no policy
add_principal: Operation requires ``add'' privilege while creating "impala/itsusmpl00509.jnj.com@JNJ.COM".
+ '[' 432000 -gt 0 ']'
++ kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/admin@JNJ.COM -r JNJ.COM -q 'getprinc -terse impala/itsusmpl00509.jnj.com@JNJ.COM'
++ tail -1
++ cut -f 12
get_principal: Operation requires ``get'' privilege while retrieving "impala/itsusmpl00509.jnj.com@JNJ.COM".
+ RENEW_LIFETIME='Authenticating as principal cloudera-scm/admin@JNJ.COM with keytab /var/run/cloudera-scm-server/cmf4619059661181081787.keytab.'
+ '[' Authenticating as principal cloudera-scm/admin@JNJ.COM with keytab /var/run/cloudera-scm-server/cmf4619059661181081787.keytab. -eq 0 ']'
/usr/share/cmf/bin/gen_credentials.sh: line 28: [: too many arguments
+ kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/admin@JNJ.COM -r JNJ.COM -q 'xst -k /var/run/cloudera-scm-server/cmf7829892990940630057.keytab impala/itsusmpl00509.jnj.com@JNJ.COM'
kadmin: Operation requires ``change-password'' privilege while changing impala/itsusmpl00509.jnj.com@JNJ.COM's key
+ chmod 600 /var/run/cloudera-scm-server/cmf7829892990940630057.keytab
chmod: cannot access `/var/run/cloudera-scm-server/cmf7829892990940630057.keytab': No such file or directory
2 ACCEPTED SOLUTIONS

avatar
Master Collaborator

You should not have to specifically add the CM principal, the */admin should handle it.

 

From what you pasted, I think you have a space missing between your COM and the "*" at the end of the first line;  Mine looks like this: 

 

[12:34 root@secsme-1 ~] > cat kadm5.acl
*/admin@COE.CLOUDERA.COM *

 

 

View solution in original post

avatar
Master Collaborator
11 REPLIES 11

avatar
Master Collaborator

avatar
Expert Contributor

Yes ,It was a typo error, I meant the space should be there. 🙂

 

*/admin@My-Realm.COM *