question Re: Kerberos authentication from windows machine? in Support Questions

Kerberos authentication from windows machine?

ben123 — Tue, 08 Nov 2016 16:05:23 GMT

Hello !

After some work I finished setting up Cloudera + MIT Kerberos + Windows AD.

from linux machine, I'm able to run "kinit ben@WIN-REALM" and then access hadoop or visit namenode webadmin. Of course I did configure SPNEGO on the web browser.

However, after logging in to my windows machine, which authenticate through windows AD, I can't access namenode webadmin which is at http://namenode:50070.

I tried running kinit from CMD but nothing changes.

this is what i get when i visit namenode webadmin.

HTTP ERROR 403

Problem accessing /index.html. Reason:

    GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)

what extra configuration do i need to do on windows to access hadoop webadmin page?

thank you!

Ben

Powered by Jetty://

Re: Kerberos authentication from windows machine?

ben123 — Tue, 22 Sep 2015 16:29:42 GMT

to answer my own question

I need to run this on windows cmd

ksetup /addkdc <REALM> <KDC hostname>
ksetup /addhosttorealmmap <httpFS hostname> <REALM>

and set SPNEGO settings on browser

Re: Kerberos authentication from windows machine?

Tomas79 — Tue, 26 Apr 2016 08:18:06 GMT

I tried the same, run the ksetup but didnt helped.
My computer is not in the AD, the KDC is dedicated to the Hadoop cluster and I try to log into the Solr Web UI.. Using curl from ANY node of the Hadoop cluster works fine, if the user has a ticket. But usiung Chrome or IE fails on Defective tokend detected.

Re: Kerberos authentication from windows machine?

ben123 — Tue, 26 Apr 2016 16:13:26 GMT

what's the error msg after "Defective tokend detected"?

also make sure all of your Cloudera server has correct /etc/krb5.conf file defined.

Re: Kerberos authentication from windows machine?

zhuw.bigdata — Thu, 05 Jan 2017 22:18:49 GMT

Same thing happened to me. Used curl on edge node without any issue.

Re: Kerberos authentication from windows machine?

sparamas — Tue, 05 Jun 2018 23:11:53 GMT

Hi Ben,

I too have similar error from Error 403. So when i tried to add kdc using ksetup from command prompt from my windows machine. Am getting this error

Failed to create Kerberos key: 5 (0x5)
Failed to open Kerberos Key: 0x5
Failed /AddKdc : 0xc0000001

Thanks

Re: Kerberos authentication from windows machine?

sparamas — Sat, 09 Jun 2018 02:32:11 GMT

Now i could add the KDC to windows. It worked for me.

Thanks

Re: Kerberos authentication from windows machine?

csguna — Sat, 09 Jun 2018 06:51:20 GMT

You should have MIT client to be installed in the windows

Re: Kerberos authentication from windows machine?

sparamas — Tue, 17 Jul 2018 17:35:54 GMT

No not required, I didn't install MIT client to my widows machine. It worked for me by adding kerberos realm name and hostname parameteres in the CMD prompt.

Re: Kerberos authentication from windows machine?

sparamas — Tue, 17 Jul 2018 17:37:24 GMT

By just doing the below has resolved my issue.

I need to run this on windows cmd

ksetup /addkdc <REALM> <KDC hostname>
ksetup /addhosttorealmmap <httpFS hostname> <REALM>

and set SPNEGO settings on browser

Re: Kerberos authentication from windows machine?

pavan_kumar — Wed, 01 Jan 2020 18:47:11 GMT

Hey sparamas,

How did you over come the below error and successfully executed the ksetup commands:

Failed to create Kerberos key: 5 (0x5)
Failed to open Kerberos Key: 0x5
Failed /AddKdc : 0xc0000001

Thanks

Re: Kerberos authentication from windows machine?

Bosoon — Wed, 04 Mar 2020 05:30:20 GMT

Could you run the administrator cmd not a normal one?

From your error, I think you have not enough privilege to run these commands.