Reply
Explorer
Posts: 15
Registered: ‎09-18-2017

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

Hi,

 

We are facing the same issue while connecting through JDBC connection. Were you able to resolve the issue?

Please help me with your findings and resolution.

 

Error message: 

[Cloudera][HiveJDBCDriver](500168) Error creating login context using ticket cache: Unable to obtain Principal Name for authentication

 

 

Thanks in advance.

Explorer
Posts: 15
Registered: ‎09-18-2017

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

[ Edited ]

Hi,

 

I followed the following approaches after that:

  1. Deleted the KRB5CCNAME environment variable containing the path to the KerberosTickets.txt.
  2. Set up the Kerberos configuration file( krb5.ini) and  entered the values as per the krb5.conf file in the dev cluster node.
  3. Set up the JAAS login configuration file with the following fields:

Client {

com.sun.security.auth.module.Krb5LoginModule required

useKeyTab=false

principal=user@COMPANY.COM

doNotPrompt=true;

};

And set the environment variable java.security.auth.login.config to the location of the JAAS config file.

  • When I  tried connecting to hive in JAVA after making these changes, the connection was made successfully.
  • But when I  tried the same code in Rstudio, I  faced exception:
    • “Error in .jcall(drv@jdrv, "Ljava/sql/Connection;", "connect", as.character(url)[1],  : 

        java.sql.SQLException: [Cloudera][HiveJDBCDriver](500168) Error creating login context using ticket cache: Unable to obtain Principal Name for authentication .”

  • Also, I tried this code in R Console, but the following exception cropped up:

“java.sql.SQLException: [Cloudera][HiveJDBCDriver](500164) Error initialized or created transport for authentication: [Cloudera][HiveJDBCDriver](500169) Unable to connect to server: GSS initiate failed”

 

My understanding is that it is R is not able to get the environment variable path. correct me if i'm wrong.

I've seen many links in google but that didn't work.

 

I'm using 

Rconsole :3.4.1 and 

RStudio : version 1.1.353

 

Please suggest us how do we proceed further.

 

Thanks

Contributor
Posts: 39
Registered: ‎05-12-2016

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

Do you have JCE installed in you system?

Explorer
Posts: 15
Registered: ‎09-18-2017

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

As I mention JASS config approach is working for me from Java code.
Problem I am facing from R Code JCE is install on my machine still i am not able to connect from R.
Could anyone help on the same
Contributor
Posts: 39
Registered: ‎05-12-2016

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

[ Edited ]

Do you connect from Windows or Linux box?

 

Are you sure that you have valid kerberos ticket on your machine? Could you run klist, please?

 

If you want to use jaas they config should more like this:

 

Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="PathToTheKeyTab"
principal="cloudera@CLOUDERA"
doNotPrompt=true;
};

 

Explorer
Posts: 15
Registered: ‎09-18-2017

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

Hi,

 

We're trying to connect from windows machine. We have a valid ticket listed from klist. The error we are getting from rstudio is :

“Error in .jcall(drv@jdrv, "Ljava/sql/Connection;", "connect", as.character(url)[1],  : 

  java.sql.SQLException: [Cloudera][HiveJDBCDriver](500168) Error creating login context using ticket cache: Unable to obtain Principal Name for authentication .”

Contributor
Posts: 39
Registered: ‎05-12-2016

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

[ Edited ]

Could you show me the output of the klist command, please?

 

Where do you cache kerberos tickets? Do you have env variable to set this up?

Explorer
Posts: 15
Registered: ‎09-18-2017

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

Hi,

 

I'm not able to klist now. After i run kdestroy -a and then i generate a ticket, the ticket is created successfully but the the ticket is not displayed through klist and the error happens to be the same. 

Contributor
Posts: 39
Registered: ‎05-12-2016

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

If you can not klist then sth is wrong. Do you have environment varialbe that points to kerberos cache path?
Explorer
Posts: 15
Registered: ‎09-18-2017

Re: impala - kerberosed - jdbc connection from SQL Workbench on Windows

Hi,

 

Just wanted to add a point: after kinit the ticket is generated succefully. It is shown in the MIT Kerberos Ticket Manager but it is not viewed in klist. We're following this link: https://www.cloudera.com/documentation/other/connectors/hive-jdbc/latest/Cloudera-JDBC-Driver-for-Ap...

 

Just few things:

1) Set an environment variable that points to kerberostickets.txt

After it didn't work:

1) Removed the environment variable and followed the next step of JAAS conf. This led to successful hive connectivity through java but in R we're getting the error

2) After running kdestroy, and then kinit. The klist does not give anything. It gives null or empty. Now unable to run it through java too. 

2) Set the environment variable again to point to CredentialCache file. It again gives empty klist.

This is in Windows machine

 

Announcements