question Re: Kerberos encryption type is not one of the expected values in Support Questions

Kerberos encryption type is not one of the expected values

svasi — Mon, 08 Mar 2021 14:03:41 GMT

Hi all.

I'm facing a CM configuration error I can't understand.

I've kerberized a Cloudera 5.16 cluster which authenticates against an AD/DC controller.

I've set aes256-cts and aes256-cts-hmac-sha1-96 encryption types.

CM reports a configuration issue:

I've a separate cluster, configured with the same values and authenticating to the same AD/DC controller, that have no errors.

I'm struggling on that error but can't solve.

Any idea?

Re: Kerberos encryption type is not one of the expected values

GangWar — Wed, 10 Mar 2021 07:26:35 GMT

@svasi Are you getting the same error when providing one value in on box, I guess you should try that and see if this works. There might be some weird issue, try to restart CM server.

Re: Kerberos encryption type is not one of the expected values

jackass — Wed, 10 Mar 2021 20:44:40 GMT

@svasi
Can you check and share your pseudonymized /etc/krb5.conf?

Re: Kerberos encryption type is not one of the expected values

svasi — Fri, 09 Apr 2021 06:36:13 GMT

I've tried to set a value at a time and restart CM.
Nothing changes

It seems to be a known bug on that CDH release
Had the opportunity to open a SR through my customer's account and support
answered that the message can be dismissed

Thanks for your answers

Re: Kerberos encryption type is not one of the expected values

GangWar — Fri, 09 Apr 2021 08:34:30 GMT

@svasi @jackass Just to close the loop. Yes Cloudera Manager will not recognize "AES" as a valid encryption type. These encryption types must match the permitted e-types listed in the /etc/krb5.conf file. We technically support what ever Kerberos supports, however the field validation only checks for cipher short names in this release. As such, if all is working well, you can safely ignore this alert.