CDH 5 Sentry Service setup kerberos PREAUTH_FAILED Error

alpertankut — Fri, 16 Sep 2022 12:17:33 GMT

During my sentry installation, I have faced an issue that gave me big flag on CDH manager.

on step 5, Sentry principal keytab is failing to authenticate.

My guess is, someone changed (or deleted and recrated) the sentry principal and CDH manager is sending a different keytab everytime I try to set the server.

I have searched the sentry keytab file on server and I see that CDH mngr creates different keytab file with different attemp number extention everytime send a request(everytime I try to set up)

1. where is the keytab file that CDH mngr keeps and sends for sentry authentication?

2. Do I have to uninstall and reinstall kerberos to get the sentry principal correctly setup? I have tried every possible way and this is the only one left.

3. Why is CDH mngr is set up like this?

This is a decision point in our company to choose best Hadoop Distro enterprice version and we already have a glitch when we were enable Kerberos in CDH

Here is the Error log:

JAVA_HOME=/usr/java/jdk1.7.0_67-cloudera
using /usr/java/jdk1.7.0_67-cloudera as JAVA_HOME
using 5 as CDH_VERSION
Debug is true storeKey true useTicketCache true useKeyTab true doNotPrompt true ticketCache is null isInitiator true KeyTab is /var/run/cloudera-scm-agent/process/1625-sentry-SENTRY_SERVER/sentry.keytab refreshKrb5Config is true principal is sentry/********.********.dev@********.DEV tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Refreshing Kerberos configuration
Acquire TGT from Cache
Principal is sentry/********.********.dev@********.DEV
null credentials from Ticket Cache
[Krb5LoginModule] authentication failed
Integrity check on decrypted field failed (31) - PREAUTH_FAILED
Mon Sep 25 08:47:18 EDT 2017
JAVA_HOME=/usr/java/jdk1.7.0_67-cloudera
using /usr/java/jdk1.7.0_67-cloudera as JAVA_HOME
using 5 as CDH_VERSION
Debug is true storeKey true useTicketCache true useKeyTab true doNotPrompt true ticketCache is null isInitiator true KeyTab is /var/run/cloudera-scm-agent/process/1625-sentry-SENTRY_SERVER/sentry.keytab refreshKrb5Config is true principal is sentry/********.********.dev@********.DEV tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Refreshing Kerberos configuration
Acquire TGT from Cache
Principal is sentry/********.********.dev@********.DEV
null credentials from Ticket Cache
[Krb5LoginModule] authentication failed
Integrity check on decrypted field failed (31) - PREAUTH_FAILED

Re: CDH 5 Sentry Service setup kerberos PREAUTH_FAILED Error

alpertankut — Mon, 25 Sep 2017 21:37:55 GMT

This issue is solved by recreating the credentials!

Re: CDH 5 Sentry Service setup kerberos PREAUTH_FAILED Error

wallace-x — Sun, 10 Nov 2019 15:32:03 GMT

Are there steps?

question Re: CDH 5 Sentry Service setup kerberos PREAUTH_FAILED Error in Archives of Support Questions (Read Only)

CDH 5 Sentry Service setup kerberos PREAUTH_FAILED Error

Re: CDH 5 Sentry Service setup kerberos PREAUTH_FAILED Error

Re: CDH 5 Sentry Service setup kerberos PREAUTH_FAILED Error