Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

anis016 — Mon, 03 Feb 2020 14:18:07 GMT

Recently I moved from the Oracle JDK 8 to Open JDK 8 (version: openjdk-1.8.0.242.b08). Cloudera version is 5.16.2. I have Kerberos, TLS enabled. When I am using Oracle JDK the below issue doesn't occur but when I switch to Open JDK then I am getting the below error. Please note that the proxy user is already enabled From the CM -> HDFS -> configuration.

JobHistoryServer Error starting JobHistoryServer org.apache.hadoop.yarn.exceptions.YarnRuntimeException: Error creating done directory: [hdfs://XXXX.YYY.COM:8020/user/history/done] at org.apache.hadoop.mapreduce.v2.hs.HistoryFileManager.tryCreatingHistoryDirs(HistoryFileManager.java:680) at org.apache.hadoop.mapreduce.v2.hs.HistoryFileManager.createHistoryDirs(HistoryFileManager.java:616) at org.apache.hadoop.mapreduce.v2.hs.HistoryFileManager.serviceInit(HistoryFileManager.java:577) at org.apache.hadoop.service.AbstractService.init(AbstractService.java:163) at org.apache.hadoop.mapreduce.v2.hs.JobHistory.serviceInit(JobHistory.java:95) at org.apache.hadoop.service.AbstractService.init(AbstractService.java:163) at org.apache.hadoop.service.CompositeService.serviceInit(CompositeService.java:107) at org.apache.hadoop.mapreduce.v2.hs.JobHistoryServer.serviceInit(JobHistoryServer.java:154) at org.apache.hadoop.service.AbstractService.init(AbstractService.java:163) at org.apache.hadoop.mapreduce.v2.hs.JobHistoryServer.launchJobHistoryServer(JobHistoryServer.java:229) at org.apache.hadoop.mapreduce.v2.hs.JobHistoryServer.main(JobHistoryServer.java:239) Caused by: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.authorize.AuthorizationException): User: RZgWaGioVf@YYY.COM is not allowed to impersonate mapred/XXXX.YYY.COM@YYY.COM at org.apache.hadoop.ipc.Client.call(Client.java:1504) at org.apache.hadoop.ipc.Client.call(Client.java:1441) at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:231) at com.sun.proxy.$Proxy16.getFileInfo(Unknown Source) at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolTranslatorPB.getFileInfo(ClientNamenodeProtocolTranslatorPB.java:788) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:258) at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:104) at com.sun.proxy.$Proxy17.getFileInfo(Unknown Source) at org.apache.hadoop.hdfs.DFSClient.getFileInfo(DFSClient.java:2168) at org.apache.hadoop.fs.Hdfs.getFileStatus(Hdfs.java:133) at org.apache.hadoop.fs.FileContext$14.next(FileContext.java:1143) at org.apache.hadoop.fs.FileContext$14.next(FileContext.java:1139) at org.apache.hadoop.fs.FSLinkResolver.resolve(FSLinkResolver.java:90) at org.apache.hadoop.fs.FileContext.getFileStatus(FileContext.java:1139) at org.apache.hadoop.fs.FileContext$Util.exists(FileContext.java:1604) at org.apache.hadoop.mapreduce.v2.hs.HistoryFileManager.mkdir(HistoryFileManager.java:733) at org.apache.hadoop.mapreduce.v2.hs.HistoryFileManager.tryCreatingHistoryDirs(HistoryFileManager.java:663)

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

lwang — Tue, 04 Feb 2020 23:08:30 GMT

Hi @anis016 ,

In CDH5.16.2 we support this OpenJDK version: 1.8u181. Please use the tested version as documented in below doc:

https://docs.cloudera.com/documentation/enterprise/release-notes/topics/rn_consolidated_pcm.html#concept_ihg_vf4_j1b

I suggest you downgrade your OpenJDK version to lower and see if that will resolve the issue.

Thanks,

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

thewayofthinkin — Wed, 05 Feb 2020 06:14:48 GMT

have you checked the tested/supported OpenJDK list?

https://docs.cloudera.com/documentation/enterprise/6/release-notes/topics/rg_java_requirements.html#concept_hzw_zyl_rcb

JDK 8u40, 8u45, 8u60, and 8u242 are not supported due to JDK issues impacting CDH functionality:

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

anis016 — Thu, 06 Feb 2020 09:18:56 GMT

Just to confirm if anyone else stumbles here! So, we skipped the u242 version as suggested because of the Kerberos issue and we installed the u232 version. And it is working now!

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

lwang — Thu, 06 Feb 2020 16:03:20 GMT

Hi @anis016 ,

Glad to hear the issue got resolved after downgrading OpenJDK version. I have seen some other customers who experienced the issues with u242 version.

Cheers!

question Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8 in Support Questions

Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8

Re: Impersonation issue after migrating from Oracle JDK 8 to Open JDK 8