question Re: Missing KDC administrator credentials. Please enter admin principal and password in Support Questions

Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Tue, 11 Dec 2018 20:14:45 GMT

I have setup kerberos and enabled in Ambari successfully on one environment but while trying the same on another environment I am facing issue while enabling kerberos. I have tried to store credentials using keytool, Rest API, checked kerberos descriptors but no luck. what else is left to check?

PFA,

missing-kdc-credentials.png

Re: Missing KDC administrator credentials. Please enter admin principal and password

sampathkumar_ma — Tue, 11 Dec 2018 20:35:18 GMT

Hi @Ankita Ghate

Check the principals in kdc server

$kadmin.local
Authenticating as principal root/admin@<realm> with password.
kadmin.local:  listprincsK/M@<realm>
kadmin/admin@<realm>
kadmin/changepw@<realm>
kadmin/KDC_SERVER_FQDN@<realm>
kiprop/KDC_SERVER_FQDN@<realm>
krbtgt/TEST.COM@TEST.COM

Must create a admin principal for enabling kerberos from ambari

$kadmin.local
$kadmin.local:  addprinc admin/admin@<realm>
WARNING: no policy specified for root/admin@<realm>; defaulting to no policy
Enter password for principal "admin/admin@<realm>":<password>
Re-enter password for principal "admin/admin@<realm>":<password>
Principal "admin/admin@<realm>" created.

While enabling the kerberos from ambari, use the below principal and corresponding password

Admin principal : admin/admin@<realm> 
admin password : <password>

Try manual kinit of the same principal on ambari-server machine like,

kinit admin/admin@REALM
Password: *******

Check if above is working fine.

Also, you can refer the below thread which talk about adding the credential using API call as temporary or Permanent

https://community.hortonworks.com/articles/42927/adding-kdc-administrator-credentials-to-the-ambari.html

Hope this helps!

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Tue, 11 Dec 2018 21:00:19 GMT

@Sampath Kumar

I have already tried above steps and again tried the same as you said from reinstalltion of kerberos but facing the same issue.

Re: Missing KDC administrator credentials. Please enter admin principal and password

rlevas — Tue, 11 Dec 2018 22:09:48 GMT

@Ankita Ghate

Can you post any relevant information from your ambari-server.log?

One thing to check is to make sure that you are using the FQDN of the KDC when specifying the host in the KDC administrator host field. You should use the FQDN in the KDC hosts field as well, but that is not as important due to the way Ambari authenticates with the target KDC.

Re: Missing KDC administrator credentials. Please enter admin principal and password

Shelton — Wed, 12 Dec 2018 05:28:52 GMT

@Ankita Ghate

Your situation is bizarre! Can you share the screenshot of the kerberization steps?

Apart from the above can you share a tokenized version of your the below files

krb5.conf
kdc.conf
kadm5.acl
/etc/hosts

share the output of $ hostname -f on the kdc server
Then if the above files are correct

Reset the password through kadmin

# kadmin.local 
Authenticating as principal admin/admin@EXAMPLE.COM with password. 
kadmin.local: change_password -pw secret123 admin@EXAMPLE.COM 
Password for "admin@EXAMPLE.COM" changed. 
kadmin.local: q

In the above sequence, I have invoked kadmin as root user and change the previous password to secret123. To ensure all is okay restart the kdc and kadmin

# /etc/rc.d/init.d/krb5kdc start 
Starting Kerberos 5 KDC: 		[ OK ] 
# /etc/rc.d/init.d/kadmin start 
Starting Kerberos 5 Admin Server: 	[ OK ]

Now you can run the Kerberos tool again to regenerate the keytabs and all the services should restart successfully

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Wed, 12 Dec 2018 21:14:50 GMT

@Robert Levas

I have checked ambari-server.log file at that time and made password store persistent by executing below command and from Ambari UI, I was able to check on save password box,

curl -H "X-Requested-By:ambari" -u admin:admin -X PUT -d '{ "Credential" : { "principal" : "kadmin/admin@EXAMPLE.COM", "key" : "123456", "type" : "persisted" } }' http://ambari-server-host-ip:8080/api/v1/clusters/Ambari_PreDev/credentials/kdc.admin.credential

But still Ambari UI is giving exception as missing credentials and not able to kerberize cluster.

Also my last admin principal created is admin/admin@EXAMPLE.COM and changed password is password.

PFA,

ambari-server-logs.png

Re: Missing KDC administrator credentials. Please enter admin principal and password

rlevas — Thu, 13 Dec 2018 00:28:10 GMT

So Ambari really cannot find the KDC administrator credentials. Can you execute the following to see if the alias exists in the Ambari credential store?

<JAVA_HOME>/bin/keytool -list -keystore /var/lib/ambari-server/keys/credentials.jceks -store-type JCEKS

For Example:

[root@c7401 ~]# /usr/jdk64/jdk1.8.0_112/bin/keytool -list -keystore /var/lib/ambari-server/keys/credentials.jceks -store-type JCEKS
Enter keystore password:
Keystore type: JCEKS
Keystore provider: SunJCE
Your keystore contains 2 entries
cluster.ambari_predev.kdc.admin.credential, Dec 12, 2018, SecretKeyEntry,
ambari.db.password, Dec 12, 2018, SecretKeyEntry,

Here you see that my persisted KDC admin credential is listed as cluster.ambari_predev.kdc.admin.credential.

If you do not see this, then something is wrong.

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Thu, 13 Dec 2018 12:09:16 GMT

@Robert Levas

It is showing output as expected PFA,

keytool-output.png

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Thu, 13 Dec 2018 19:13:53 GMT

@Geoffrey Shelton Okot

Apart from the above can you share a tokenized version of your the below files- Sorry I did not get what you have asked.

klist -V Kerberos 5 version 1.13.2

And KDC server's hostname -f output is --> ubuntu19.example.com

Check attached files of KDC server,

krb5conf.png kdcconf.png kadm5conf.png hosts.png

Re: Missing KDC administrator credentials. Please enter admin principal and password

rlevas — Tue, 18 Dec 2018 00:19:22 GMT

I am at a loss as far as what the issue is. All tests I have proposed yielded results that make it seem like all should be working. Maybe

Manually remove the credential from the credential store
Restart Ambari
Add it again, through Ambari when it asks for it

To remove the credential using keytool -

<JAVA_HOME>/bin/keytool -remove -alias  -keystore /var/lib/ambari-server/keys/credentials.jceks -store-type JCEKS

Re: Missing KDC administrator credentials. Please enter admin principal and password

Shelton — Tue, 18 Dec 2018 01:38:45 GMT

@Ankita Ghate

Find attached the tokenized version of my files.

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Tue, 18 Dec 2018 12:10:42 GMT

Ok.

You can check files which I have already attached in above comments. Absolute path of files are /etc/hosts, /etc/krb5.conf, /etc/krbkdc/kadm5.acl, /etc/krb5kdc/kdc.conf

PFA,

Re: Missing KDC administrator credentials. Please enter admin principal and password

Shelton — Tue, 18 Dec 2018 17:56:36 GMT

@Ankita Ghate

The values look correct, I guess you are running ubuntu that's why the path differs a bit from my centos ! Can you start the equivalent of these services and retry

service krb5kdc start 
service kadmin start

Can you share the screenshot of the parameters you are using in the Enabling kerberos wizard ?

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Thu, 20 Dec 2018 12:39:31 GMT

@Geoffrey Shelton Okot

PFA for services restart,

services-restart.png

Re: Missing KDC administrator credentials. Please enter admin principal and password

Shelton — Fri, 21 Dec 2018 03:33:22 GMT

@Ankita Ghate

Now can you proceed with the kerberization check the 2 screenshots attached ensure your input values are correct.

Please revert

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Fri, 21 Dec 2018 15:09:24 GMT

All,

Thanks for your response. I found the root cause of this issue in my case, Ambari was using Ambari master key for KDC admin credentials which was present at /var/lib/ambari-server/keys/credentials.jceks. I have taken backup of it and was able to work on 'Enable kerberos through Ambari UI'.

But that previous file is required at the time of ambari-server restart. So need to keep ambari-master key same as KDC admin key (password).

PFA,

kerberos-admin-creds-issue-solved.png

Re: Missing KDC administrator credentials. Please enter admin principal and password

ankita_ghate — Fri, 21 Dec 2018 22:30:06 GMT

All,

Thanks for your response. I found the root cause of the issue. Ambari was using its master's key in KDC admin credentials that is why it was giving "Missing KDC administrator credentials. Please enter admin principal and password". So I have removed that crendential file (PFA for this) and issue has been solved.

For others, you may need to keep ambari master key and KDC admin creds same, because that file is required at the time of ambari-server restart (if you have configured jceks).

PFA,

kerberos-admin-creds-issue-solved.png