question Why I'm able to access the hdfs even after kerberos ticket is expired. in Archives of Support Questions (Read Only)

Why I'm able to access the hdfs even after kerberos ticket is expired.

nyadav — Tue, 03 Jan 2017 20:21:02 GMT

I've modified the principal maxlife to 5min, as per the theory I should not be able to access the hdfs after 5min. But for me ticket is expiring after 10min. Any idea?

WARN ipc.Client: Exception encountered while connecting to the server : 
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]

modified maxlife using below command,

modprinc -maxlife "5minutes" hdfs-n@HWXBLR.COM

Re: Why I'm able to access the hdfs even after kerberos ticket is expired.

krajguru — Tue, 03 Jan 2017 20:35:34 GMT

The default value for maximum clock skew is 300 seconds, or five minutes. So by default, the kerberos server will refuse to issue tickets only if the clocks are out of sync by more than 5 minutes, hence you are allowed to access the service or renew tickets till the acceptable clock skew time. MIT ClockSkew

Re: Why I'm able to access the hdfs even after kerberos ticket is expired.

nyadav — Tue, 03 Jan 2017 20:56:37 GMT

thanks @krajguru for response. So it is expected behavior. Can we reduce this clock skew and is it advised to reduce it?

Re: Why I'm able to access the hdfs even after kerberos ticket is expired.

krajguru — Tue, 03 Jan 2017 21:47:20 GMT

@nyadav You can change this default value of 300 seconds in the [libdefaults] section of the krb5.conf file. But for security reasons, do not increase the clock skew beyond 300 seconds.