Skip to main content
dstreev
Gold ⭐️
dstreev
Gold ⭐️
September 26, 2015
Solved

Fix distcp Fallback to Simple Auth Error in Secure Clusters

hadoop distcp -i -log /tmp/ hdfs://xxx:8020/apps/yyyy hdfs://xxx_cid/tmp/

In this case the "xxx" is the "un-secure" cluster, while "xxx_cid" in the secure cluster.

We are launching the job from the Kerberos cluster, with the appropriate kinit for the user and getting the following error:

java.io.IOException: Failed on local exception: java.io.IOException: Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections.; Host Details : local host is: "xxx/10.x.x.x"; destination host is: "xxx":8020;

...

Caused by: java.io.IOException: Server asks us to fall back to SIMPLE auth, but this client is configured to only allow secure connections.

I thought by launching the job from the secure cluster, that we could avoid any access issues. But it appears that the processes are kicked off from the "source" cluster. In this case, that's the insecure cluster.

Idea's on getting around this?

    cnauroth
    cnaurothAnswer
    Gold ⭐️
    November 19, 2015

    I recommend not setting this in core-site.xml, and instead setting it on the command line invocation specifically for the DistCp command that needs to communicate with the unsecured cluster. Setting it in core-site.xml means that all RPC connections for any application are eligible for fallback to simple authentication. This potentially expands the attack surface for man-in-the-middle attacks.

    Here is an example of overriding the setting on the command line while running DistCp:

    hadoop distcp -D ipc.client.fallback-to-simple-auth-allowed=true hdfs://nn1:8020/foo/bar hdfs://nn2:8020/bar/foo

    The command must be run while logged into the secured cluster, not the unsecured cluster.

    View in thread

    17 replies

    stevel
    Gold ⭐️
    stevel
    Gold ⭐️
    September 26, 2015

    sounds like the distcp process is running secure, but is configured to not like simple connections.

    try setting the config option

    ipc.client.fallback-to-simple-auth-allowed=true

    Translate
      pardeep_kumar
      pardeep_kumar
      Gold ⭐️
      September 29, 2015

      @dstreever@hortonworks.com To use Distcp for copying between a secure cluster and an insecure one, add the following to the HDFS core-default.xml, by using Ambari.

      <property>
      <name>ipc.client.fallback-to-simple-auth-allowed</name>
      <value>true</value>
      </property>

      Translate
        jkiran2020
        jkiran2020
        Silver ⭐️
        March 28, 2018

        Adding this property in core-site.xml helped resolve the error.

        Translate
        nsabharwal
        nsabharwal
        Gold ⭐️
        November 5, 2015

        @Pardeep Nice find! Link

        When copying data from a secure cluster to a secure cluster, the following configuration setting is required in the core-site.xml file:

        <property>
        <name>hadoop.security.auth_to_local</name>
        <value></value>
        <description>Maps kerberos principals to local user names</description>
        </property>

        Translate
        cnauroth
        cnaurothAnswer
        Gold ⭐️
        November 19, 2015

        I recommend not setting this in core-site.xml, and instead setting it on the command line invocation specifically for the DistCp command that needs to communicate with the unsecured cluster. Setting it in core-site.xml means that all RPC connections for any application are eligible for fallback to simple authentication. This potentially expands the attack surface for man-in-the-middle attacks.

        Here is an example of overriding the setting on the command line while running DistCp:

        hadoop distcp -D ipc.client.fallback-to-simple-auth-allowed=true hdfs://nn1:8020/foo/bar hdfs://nn2:8020/bar/foo

        The command must be run while logged into the secured cluster, not the unsecured cluster.

        Translate
          nsabharwal
          nsabharwal
          Gold ⭐️
          November 21, 2015

          @Chris Nauroth Thanks for sharing this. Could you update the answer with more details? I believe this is the best answer if you can add more details.

          Translate
          cnauroth
          cnauroth
          Gold ⭐️
          November 24, 2015

          @Neeraj Sabharwal, thank you. I updated the answer to show an example of overriding the property from the DistCp command line.

          Translate
            hari_prsd14
            hari_prsd14
            Silver ⭐️⭐️
            March 16, 2016

            1. getting below error after running the command "hadoop distcp -D ipc.client.fallback-to-simple-auth-allowed=true hdfs://nn1:8020/foo/bar hdfs://nn2:8020/bar/foo"
            2. java.io.EOFException:End of FileException between local host is***; destination host is:***;
            3. please suggest
            Translate
            irunker
            irunker
            Silver ⭐️
            September 30, 2024

            非安全集群被阻止rpc通信，使用webhdfs协议，hadoop distcp -D ipc.client.fallback-to-simple-auth-allowed=true webhdfs://nn1:50070/foo/bar hdfs://nn2:8020/bar/foo

            Translate
            hari_prsd14
            hari_prsd14
            Silver ⭐️⭐️
            March 16, 2016

            getting below error after running the command "hadoop distcp -D ipc.client.fallback-to-simple-auth-allowed=true hdfs://nn1:8020/foo/bar hdfs://nn2:8020/bar/foo"

            java.io.EOFException: End of File Exception between local host is *** ; destination host is:***;


            please suggest

            Translate
            kshaffer_tpgs
            kshaffer_tpgs
            Silver ⭐️
            May 13, 2016

            I have found that using webhdfs instead of hdfs for the nonsecure host gets around this error, e.g.,

            "hadoop distcp -D ipc.client.fallback-to-simple-auth-allowed=true webhdfs://nn1:8020/foo/bar hdfs://nn2:8020/bar/foo"

            Translate
              turing_nix
              turing_nix
              Silver ⭐️⭐️
              April 5, 2017

              Am doing distcp from insecure to secure hadop cluster and am getting error "SIMPLE authentication isnot enabled". Can any one suggest.

              hdfs@master02:~> hadoop distcp -Dipc.client.fallback-to-simple-auth-allowed=true hdfs://HDP23:8020/test01.txt hdfs://HDP24:8020/

              17/04/0500:09:28 ERROR tools.DistCp:Invalid arguments:org.apache.hadoop.security.AccessControlException: SIMPLE authentication isnot enabled.Available:[TOKEN, KERBEROS]

              Translate
              badmanlive085
              badmanlive085
              Silver ⭐️
              April 17, 2019

              LiteBlue is the U.S. Government website this is intended for authorized use only by Postal Service employees

              Translate
              Terms & ConditionsAccessibility statement