question Re: SPNEGO access for oozie/timelineserver ui with multiple windows tickets in Archives of Support Questions (Read Only)

SPNEGO access for oozie/timelineserver ui with multiple windows tickets

bleonhardi — Fri, 16 Sep 2022 09:45:44 GMT

We have a user at xxxx who wants to access the web ui but gets a 401 on his windows machine. We have a valid ticket for the realm of the cluster but also a ticket for a different realm. ( the primary realm of the machine ) . We have done the steps for preparing firefox as specified in the storm ui question but it does not work. Any idea how to specify a principal?

Also little addon. We sometimes see a 302 in CURL instead of a 200. We can also see this in the Ambari alerts. But ambari seems to think its ok ( as in timeline server is 302 and oozie 200 but I got 302 in oozie curl ) What does this mean exactly?

Re: SPNEGO access for oozie/timelineserver ui with multiple windows tickets

stevel — Fri, 23 Oct 2015 17:08:55 GMT

I can't think of anything obvious, but theres some online instructions on using Chrome; that may behave differently:

http://www.ghostar.org/2015/06/google-chrome-spnego-and-webhdfs-on-hadoop/

Re: SPNEGO access for oozie/timelineserver ui with multiple windows tickets

rlevas — Fri, 23 Oct 2015 23:53:51 GMT

The HTTP 302 code is a redirect response. This shouldn't affect your ability to authenticate with the web app via your browser. So something with your configuration may be wrong. I assume that you entered the Oozie UI server information in as a trusted URI.

Also, maybe this might help - http://www.microhowto.info/howto/configure_firefox_to_authenticate_using_spnego_and_kerberos.html

Re: SPNEGO access for oozie/timelineserver ui with multiple windows tickets

bleonhardi — Mon, 26 Oct 2015 11:52:05 GMT

Thanks for the links, but I think we followed the instructions from the wiki ( adding the url into the firefox settings) do you think its possible that the issue is having multiple kerberos tickets in the windows machine? Does SPNEGO send all in other words or only the primary one ( which would be the wrong one the user directly gets from AD )

Re: SPNEGO access for oozie/timelineserver ui with multiple windows tickets

rlevas — Mon, 26 Oct 2015 20:32:40 GMT

What Kerberos client is installed on the Windows machine?

How did the 2nd ticket get established? If using MIT Kerberos libraries, one would kinit to do this.

Re: SPNEGO access for oozie/timelineserver ui with multiple windows tickets

aervits — Wed, 03 Feb 2016 01:23:13 GMT

@Benjamin Leonhardi 🙂