question Re: cant create a kerberos ticket in Archives of Support Questions (Read Only)

cant create a kerberos ticket

aliyesami — Thu, 01 Dec 2016 07:13:43 GMT

I cant create a ticket I think I need one because beeline is failing to connect to hive2 server .

[root@hadoop1 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin/admin@TOLLS.DOT.STATE.FL.US
Valid starting     Expires            Service principal
11/30/16 17:00:42  12/01/16 17:00:42  krbtgt/TOLLS.DOT.STATE.FL.US@TOLLS.DOT.STATE.FL.US
        renew until 11/30/16 17:00:42
[root@hadoop1 ~]# kinit hive
kinit: Client not found in Kerberos database while getting initial credentials
[root@hadoop1 ~]#

beeline error

beeline> !connect jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US
Connecting to jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US
Enter username for jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US: hive
Enter password for jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US: *******
16/11/30 18:09:19 [main]: ERROR transport.TSaslTransport: SASL negotiation failure
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]

Re: cant create a kerberos ticket

rmani — Thu, 01 Dec 2016 07:25:12 GMT

" Error: Client not found in Kerberos database while getting initial credentials" , is saying that principal 'hive' is not in the KDC , you need to create one to do a kinit with it.

Re: cant create a kerberos ticket

Ravi_G — Thu, 01 Dec 2016 07:29:09 GMT

@Sami Ahmad

This is the right way to get service tickets.

[root@gwy-ravi ~]#
[root@gwy-ravi ~]#
[root@gwy-ravi ~]# klist -kt /etc/security/keytabs/hive.service.keytab
Keytab name: FILE:/etc/security/keytabs/hive.service.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 11/16/16 22:54:16 hive/gwy-ravi.ironman.com@RAVI.COM
   2 11/16/16 22:54:16 hive/gwy-ravi.ironman.com@RAVI.COM
   2 11/16/16 22:54:16 hive/gwy-ravi.ironman.com@RAVI.COM
   2 11/16/16 22:54:16 hive/gwy-ravi.ironman.com@RAVI.COM
   2 11/16/16 22:54:16 hive/gwy-ravi.ironman.com@RAVI.COM
[root@gwy-ravi ~]# kinit -kt /etc/security/keytabs/hive.service.keytab hive/gwy-ravi.ironman.com@RAVI.COM
[root@gwy-ravi ~]#
[root@gwy-ravi ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hive/gwy-ravi.ironman.com@RAVI.COM


Valid starting     Expires            Service principal
11/30/16 23:28:30  12/01/16 23:28:30  krbtgt/RAVI.COM@RAVI.COM
	renew until 11/30/16 23:28:30
[root@gwy-ravi ~]#

Re: cant create a kerberos ticket

aliyesami — Thu, 01 Dec 2016 07:36:49 GMT

ok I created the hive/admin principal in KDC is this correct ?

[root@hadoop1 ~]# kadmin.local
Authenticating as principal admin/admin@TOLLS.DOT.STATE.FL.US with password.
kadmin.local:  addprinc hive/admin
WARNING: no policy specified for hive/admin@TOLLS.DOT.STATE.FL.US; defaulting to no policy
Enter password for principal "hive/admin@TOLLS.DOT.STATE.FL.US":
Re-enter password for principal "hive/admin@TOLLS.DOT.STATE.FL.US":
Principal "hive/admin@TOLLS.DOT.STATE.FL.US" created.
[root@hadoop1 ~]# kinit hive/admin
Password for hive/admin@TOLLS.DOT.STATE.FL.US:
[root@hadoop1 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hive/admin@TOLLS.DOT.STATE.FL.US
Valid starting     Expires            Service principal
11/30/16 18:45:50  12/01/16 18:45:50  krbtgt/TOLLS.DOT.STATE.FL.US@TOLLS.DOT.STATE.FL.US
        renew until 11/30/16 18:45:50

Re: cant create a kerberos ticket

aliyesami — Thu, 01 Dec 2016 07:54:14 GMT

ok it worked , thanks a lot for your help . I had to create the ticket as user hive before starting beeline.

[hive@hadoop1 ~]$ kinit hive
Password for hive@TOLLS.DOT.STATE.FL.US:
[hive@hadoop1 ~]$ klist
Ticket cache: FILE:/tmp/krb5cc_1004
Default principal: hive@TOLLS.DOT.STATE.FL.US
Valid starting     Expires            Service principal
11/30/16 18:52:14  12/01/16 18:52:14  krbtgt/TOLLS.DOT.STATE.FL.US@TOLLS.DOT.STATE.FL.US
        renew until 11/30/16 18:52:14
[hive@hadoop1 ~]$ beeline
Beeline version 1.2.1000.2.5.0.0-1245 by Apache Hive
beeline> !connect jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US
Connecting to jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US
Enter username for jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US: hive
Enter password for jdbc:hive2://hadoop2:10000/default;principal=hive/hadoop2@TOLLS.DOT.STATE.FL.US: *******
Connected to: Apache Hive (version 1.2.1000.2.5.0.0-1245)
Driver: Hive JDBC (version 1.2.1000.2.5.0.0-1245)
Transaction isolation: TRANSACTION_REPEATABLE_READ
0: jdbc:hive2://hadoop2:10000/default>