question Re: Oozie job failing due to Kerberos error in Archives of Support Questions (Read Only)

Oozie job failing due to Kerberos error

ajay_kumar — Fri, 29 Apr 2016 01:54:52 GMT

Oozie java action is failing with below error. We have tried passing credentials from oozie as well as principal,keytab based authentication from driver using below config.

conf.set("hadoop.security.authentication", "kerberos");
conf.set("java.security.krb5.conf", "/etc/krb5.conf");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("principal", "keytab");

Failing Oozie Launcher, Main class [org.apache.oozie.action.hadoop.JavaMain], main() threw exception, java.io.IOException: Can't get Master Kerberos principal for use as renewer
org.apache.oozie.action.hadoop.JavaMainException: java.io.IOException: Can't get Master Kerberos principal for use as renewer
at org.apache.oozie.action.hadoop.JavaMain.run(JavaMain.java:58)
at org.apache.oozie.action.hadoop.LauncherMain.run(LauncherMain.java:39)
at org.apache.oozie.action.hadoop.JavaMain.main(JavaMain.java:36)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.oozie.action.hadoop.LauncherMapper.map(LauncherMapper.java:226)
at org.apache.hadoop.mapred.MapRunner.run(MapRunner.java:54)
at org.apache.hadoop.mapred.MapTask.runOldMapper(MapTask.java:450)
at org.apache.hadoop.mapred.MapTask.run(MapTask.java:343)

Re: Oozie job failing due to Kerberos error

cnormile — Fri, 29 Apr 2016 02:27:53 GMT

If you are using Yarn, the Yarn gateway roles need to be provided to the workflow.

Re: Oozie job failing due to Kerberos error

ajay_kumar — Tue, 03 May 2016 01:25:55 GMT

Adding HADOOP_TOKEN_FILE_LOCATION resolved the issue.

-D mapreduce.job.credentials.binary=$HADOOP_TOKEN_FILE_LOCATION

Re: Oozie job failing due to Kerberos error

vuyyuru_sriniva — Thu, 21 Jul 2016 05:15:19 GMT

how to provide Yarn gateway roles to the workflow ?

Re: Oozie job failing due to Kerberos error

vuyyuru_sriniva — Thu, 21 Jul 2016 05:17:59 GMT

Did you have to keep below as well?

conf.set("hadoop.security.authentication","kerberos");
conf.set("java.security.krb5.conf","/etc/krb5.conf");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("principal","keytab");