question Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag" in Archives of Support Questions (Read Only)

Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

hosako — Fri, 16 Sep 2022 09:47:18 GMT

HDP version : 2.3.0 Ambari version: 2.1.0

Enabled Kerberos with Windows Active Directory (not cross-realm) from Ambari.

Confirmed kinit and curl to WebHDFS worked with an AD user.

Followed http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.0/bk_Ambari_Security_Guide/content/_configuring_http_authentication_for_HDFS_YARN_MapReduce2_HBase_Oozie_Falcon_and_Storm.html

Again, confirmed kdestroy & kinit and curl to WebHDFS and NameNode UI worked with an AD user.

Now, tried to access HDP NameNode UI page from Firefox on Windows PC.

Copied /etc/krb5.conf to C:\Windows\krb5.ini.
Followed some instruction found on internet to set up Firefox.
And didn't work. The error was "GSSHeader did not find the right tag"

For troubleshooting purpose, downloaded curl.exe from http://curl.haxx.se/download.html

Trying to access HDP, for example, NameNode:50070 with curl --negotiate, and got same error "GSSHeader did not find the right tag"

Copied "/etc/security/keytabs/spnego.service.keytab" into Windows and did kinit -k -t and curl --negotiate but same error.

Does anyone know what would be missing to make Windows PC work to access secured web page?

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

rlevas — Mon, 02 Nov 2015 19:11:22 GMT

Have you tried to use another browser like Internet Explorer or Chrome? I understand that you tried curl as well as Firefox, but both may have issues on Windows.

What version of Windows are you using?

Does the user use that Active Directory to login to the Windows box or are you kinit-ing manually?

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

jstraub — Mon, 02 Nov 2015 20:03:18 GMT

You're probably running into the latest JDK/Kerberos issue.

What JDK Version do you have? 1.8.0_40?

The JDK 1.8.0_40 has a bug and throws the following error:

GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
The token supplied by the client is not accepted by the server.

This is because Windows sends an NTLM based ticket not a kerberos based ticket.

I had this issue a couple weeks ago, it is fixed in 1.8.0_60, so the easiest way is to upgrade the JDK on your nodes.

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

hosako — Tue, 03 Nov 2015 10:35:51 GMT

Thanks. Found http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8080129

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

jstraub — Tue, 03 Nov 2015 18:49:53 GMT

Thanks for the official Oracle bug reference. I'll see if I can raise this internally and we can change the default/recommended JDK to 1.8.0_60 in our docs

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

nsabharwal — Mon, 30 Nov 2015 08:46:48 GMT

@Hajime Thanks for sharing the bug details.

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

bhaveshvv109 — Thu, 30 Jun 2016 19:20:14 GMT

I am also getting same error when I tried to access web UI from Window Machine.

Could you please let me know what actions I should take in order to access the HDP Web UI. I am able to access same Web UI using curl on one of my hadoop cluster machine (Linux) but same URL is not working from Window 7 Machine (Chrome Version 51.0.2704.103 m). It asks for username and password and I supplied the same which I have created on Kerberos Server but no success.

We are using HDP-2.4.0, Kerberos5 and JDK-1.8.0_60

Error Message on Browser: GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)

Please note: My cluster is on example.com which is specific to HDP cluster only and my windows machine is connected with different AD realm and we do not want to create any relationship between them, whatever changes required we can make on client machine (Windows 7) and HDP cluster only.

Appreciate your help.

Thanks

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

RajbMandal — Thu, 04 Aug 2016 21:21:27 GMT

@Jonas Straub

I use JDK "1.8.0_91".But still getting same error.

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

shyamshaw — Mon, 16 Jan 2017 19:37:26 GMT

@Jonas Straub

I am using jdk1.8.0_60 but still facing the same issue when accessing web UI's.

GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

shyamshaw — Mon, 16 Jan 2017 21:40:48 GMT

@Jonas Straub

Issue is now resolved. The issue was with kerberos ticket and not with JDK. Thanks!!!

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

prashantb123a — Tue, 11 Apr 2017 21:01:13 GMT

I am getting same error. I have openjdk version "1.8.0_121". Hadoop cluster (HDP 2.5) is kerberized.

Could you please help me here?

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

ujfjhz — Fri, 05 May 2017 09:24:58 GMT

Hello @Shyam Shaw, could you please teach me how did you resolved this issue? Thank you.

I've googled a lot and always get this error.

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

sachinsga_com — Tue, 05 Sep 2017 16:10:16 GMT

Hey @Shyam Shaw, could you please help me with the solution for this problem ?

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

shyamshaw — Tue, 05 Sep 2017 16:25:41 GMT

Hi, @sachin gupta Are you using AD Kerberos or MIT? When you try to access Web UI, it will ask for username/password.

We had AD Kerberos in our environment. We were passing username (after successful kinit for that user) in the username field and password for that user and receiving error "GSSHeader did not find the right tag".

Here you need to pass your realm along with the username in username field like username@<REALM>.

Also, check you JDK version.

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

sachinsga_com — Tue, 05 Sep 2017 18:18:43 GMT

@Shyam Shaw We are using MIT. I am creating the ticket using MIT client for windows and gave the username as you had suggested with realm and password but still I am gettingGSSHeader did not find the right tag. Could you please help me with some more clues which I can try to make it work.

And one more thing I tried to access the RM web console using a linux machine, on that its throwing "Authentication Required" error.

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Shelton — Tue, 05 Sep 2017 18:43:17 GMT

@sachin gupta

This is a very old thread and the issue was solved by Jonas, for a new case please open a new thread. Member tend to ignore very OLD threads

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

sachinsga_com — Tue, 05 Sep 2017 22:39:42 GMT

thanks for suggesting. Created a new thread

https://community.hortonworks.com/questions/135805/accessing-hdp-web-ui-from-windows-pc-causes-gsshea-1.html