Kerberos:Error occured in generating credentials

[#1]

Hi,

I was enabling kerberos from cloudera manager.

Everything worked fine but when it tried to do the step of "generating Credentials" it gave me an error.

Please find the error.

Any suggestions?

Waiting for the reply

/usr/share/cmf/bin/gen_credentials.sh failed with exit code 1 and output of <<
+ export PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/sbin:/usr/sbin:/bin:/usr/bin
+ PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/sbin:/usr/sbin:/bin:/usr/bin
+ CMF_REALM=JNJ.COM
+ KEYTAB_OUT=/var/run/cloudera-scm-server/cmf7829892990940630057.keytab
+ PRINC=impala/[email protected]
+ MAX_RENEW_LIFE=432000
+ KADMIN='kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/[email protected] -r JNJ.COM'
+ RENEW_ARG=
+ '[' 432000 -gt 0 ']'
+ RENEW_ARG='-maxrenewlife "432000 sec"'
+ kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/[email protected] -r JNJ.COM -q 'addprinc -maxrenewlife "432000 sec" -randkey impala/[email protected]'
WARNING: no policy specified for impala/[email protected]; defaulting to no policy
add_principal: Operation requires ``add'' privilege while creating "impala/[email protected]".
+ '[' 432000 -gt 0 ']'
++ kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/[email protected] -r JNJ.COM -q 'getprinc -terse impala/[email protected]'
++ tail -1
++ cut -f 12
get_principal: Operation requires ``get'' privilege while retrieving "impala/[email protected]".
+ RENEW_LIFETIME='Authenticating as principal cloudera-scm/[email protected] with keytab /var/run/cloudera-scm-server/cmf4619059661181081787.keytab.'
+ '[' Authenticating as principal cloudera-scm/[email protected] with keytab /var/run/cloudera-scm-server/cmf4619059661181081787.keytab. -eq 0 ']'
/usr/share/cmf/bin/gen_credentials.sh: line 28: [: too many arguments
+ kadmin -k -t /var/run/cloudera-scm-server/cmf4619059661181081787.keytab -p cloudera-scm/[email protected] -r JNJ.COM -q 'xst -k /var/run/cloudera-scm-server/cmf7829892990940630057.keytab impala/[email protected]'
kadmin: Operation requires ``change-password'' privilege while changing impala/[email protected]'s key
+ chmod 600 /var/run/cloudera-scm-server/cmf7829892990940630057.keytab
chmod: cannot access `/var/run/cloudera-scm-server/cmf7829892990940630057.keytab': No such file or directory

[#2 · Accepted solution]

You should not have to specifically add the CM principal, the */admin should handle it.

From what you pasted, I think you have a space missing between your COM and the "*" at the end of the first line;  Mine looks like this: 

[12:34 root@secsme-1 ~] > cat kadm5.acl
*/[email protected] *

[#3 · Accepted solution]

Just FYI, it should have a space

http://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/kadm5_acl.html

[#4]

Yes ,It was a typo error, I meant the space should be there. 🙂

*/[email protected] *