question Re: Error: Attempted to add a rule for a principal with no realm: ambari-qa in Support Questions

Error: Attempted to add a rule for a principal with no realm: ambari-qa

vzlatkin — Wed, 13 Jan 2016 23:25:41 GMT

I am trying to enable Kerberos on an HDP 2.3.2 Sandbox using FreeIPA on a standalone VM. After stopping all of the HDP services the Kerberos wizard has a "prepare" task and that task is failing with this error message:

13 Jan 2016 04:56:25,610  WARN [Server Action Executor Worker 495] ServerActionExecutor:479 - Task #495 failed to complete execution due to thrown exception: java.lang.IllegalArgumentException:Attempted to add a rule for a principal with no realm: ambari-qa
java.lang.IllegalArgumentException: Attempted to add a rule for a principal with no realm: ambari-qa
        at org.apache.ambari.server.controller.AuthToLocalBuilder.addRule(AuthToLocalBuilder.java:147)
        at org.apache.ambari.server.controller.KerberosHelperImpl.addIdentities(KerberosHelperImpl.java:1671)
        at org.apache.ambari.server.controller.KerberosHelperImpl.setAuthToLocalRules(KerberosHelperImpl.java:403)
        at org.apache.ambari.server.serveraction.kerberos.PrepareKerberosIdentitiesServerAction.processAuthToLocalRules(PrepareKerberosIdentitiesServerAction.java:177)
        at org.apache.ambari.server.serveraction.kerberos.PrepareEnableKerberosServerAction.execute(PrepareEnableKerberosServerAction.java:82)
        at org.apache.ambari.server.serveraction.ServerActionExecutor$Worker.execute(ServerActionExecutor.java:537)
        at org.apache.ambari.server.serveraction.ServerActionExecutor$Worker.run(ServerActionExecutor.java:474)
        at java.lang.Thread.run(Thread.java:745)

ambari-qa was not mentioned in the CSV file that the wizard generated, but after seeing the above error I created a service for it, but I'm still getting the same error.

Added service "ambari-qa/sandbox.hortonworks.com@HORTONWORKS.COM"
-----------------------------------------------------------------
  Principal: ambari-qa/sandbox.hortonworks.com@HORTONWORKS.COM
  Managed by: sandbox.hortonworks.com

What does the error message mean and what can I do to resolve it?

Re: Error: Attempted to add a rule for a principal with no realm: ambari-qa

rlevas — Wed, 13 Jan 2016 23:58:25 GMT

It seems like something may be wrong with the Kerberos Descriptor. Did you edit any of the principal names on the Configure Identities page of the Enable Kerberos Wizard or did you not set the realm name on the Configure Kerberos page of the Enable Kerberos Wizard?

Can you post or attach the response to

http://AMBARI_SERVER:8080/api/v1/clusters/CLUSTER_NAME/artifacts/kerberos_descriptor

Replacing AMBARI_SERVER with the hostname of your Ambari server
Replace CLUSTER_NAME with the name of your cluster

Re: Error: Attempted to add a rule for a principal with no realm: ambari-qa

vzlatkin — Thu, 14 Jan 2016 02:00:23 GMT

Yes, I changed the identities as specified here. Realm was filled in during the first step of the Enable Kerberos Wizard.

The output of from the URL is very long, so I won't post it here. There is no mention of ambari-qa, and realm is a filled in property. Is there anything specific that I should investigate?

Re: Error: Attempted to add a rule for a principal with no realm: ambari-qa

rlevas — Thu, 14 Jan 2016 02:49:22 GMT

Your issue is with the smoke user principal, on line 29 of the Kerberos Descriptor you posted:

  "value" : "${cluster-env/smokeuser}",

It should be:

  "value" : "${cluster-env/smokeuser}@${realm}",

Re: Error: Attempted to add a rule for a principal with no realm: ambari-qa

vzlatkin — Thu, 14 Jan 2016 03:11:50 GMT

That worked!