Kerberos Generate Credentials fails

[#1]

Hi,

I'm trying to configure kerberos on a single user installation.

I've created the cloudera-scm/[email protected] and was able to kinit it manually but I keep falling at the Generate Credentials phase:

/usr/share/cmf/bin/gen_credentials.sh failed with exit code 1 and output of <<
+ export PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/sbin:/usr/sbin:/bin:/usr/bin
+ PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/sbin:/usr/sbin:/bin:/usr/bin
+ CMF_REALM=MYREALM.COM
+ KEYTAB_OUT=/var/run/cloudera-scm-server/cmf470480807619850998.keytab
+ PRINC=yarn/[email protected]
+ MAX_RENEW_LIFE=604800
+ KADMIN='kadmin -k -t /var/run/cloudera-scm-server/cmf7525098316801008285.keytab -p cloudera-scm/[email protected] -r MYREALM.COM'
+ RENEW_ARG=
+ '[' 604800 -gt 0 ']'
+ RENEW_ARG='-maxrenewlife "604800 sec"'
+ '[' -z /var/run/cloudera-scm-server/krb58981110957643724339.conf ']'
+ echo 'Using custom config path '\''/var/run/cloudera-scm-server/krb58981110957643724339.conf'\'', contents below:'
+ cat /var/run/cloudera-scm-server/krb58981110957643724339.conf
+ kadmin -k -t /var/run/cloudera-scm-server/cmf7525098316801008285.keytab -p cloudera-scm/[email protected] -r MYREALM.COM -q 'addprinc -maxrenewlife "604800 sec" -randkey yarn/[email protected]'
WARNING: no policy specified for yarn/[email protected]; defaulting to no policy
add_principal: Operation requires ``add'' privilege while creating "yarn/[email protected]".
+ '[' 604800 -gt 0 ']'
++ kadmin -k -t /var/run/cloudera-scm-server/cmf7525098316801008285.keytab -p cloudera-scm/[email protected] -r MYREALM.COM -q 'getprinc -terse yarn/[email protected]'
++ tail -1
++ cut -f 12
get_principal: Operation requires ``get'' privilege while retrieving "yarn/[email protected]".
+ RENEW_LIFETIME='Authenticating as principal cloudera-scm/[email protected] with keytab /var/run/cloudera-scm-server/cmf7525098316801008285.keytab.'
+ '[' Authenticating as principal cloudera-scm/[email protected] with keytab /var/run/cloudera-scm-server/cmf7525098316801008285.keytab. -eq 0 ']'
/usr/share/cmf/bin/gen_credentials.sh: line 35: [: too many arguments
+ kadmin -k -t /var/run/cloudera-scm-server/cmf7525098316801008285.keytab -p cloudera-scm/[email protected] -r MYREALM.COM -q 'xst -k /var/run/cloudera-scm-server/cmf470480807619850998.keytab yarn/[email protected]'
kadmin: Operation requires ``change-password'' privilege while changing yarn/[email protected]'s key
+ chmod 600 /var/run/cloudera-scm-server/cmf470480807619850998.keytab
chmod: cannot access `/var/run/cloudera-scm-server/cmf470480807619850998.keytab': No such file or directory

>>

Thanks,

Daniel

[#2 · Accepted solution]

So as you read through the error message, (the middle here being signficant) this line appears to be indicating at least part of the problem, as well as the others like it, that follow.

add_principal: Operation requires ``add'' privilege while creating "yarn/[email protected]".

You would want to review your /var/kerberos/krb5kdc/kadmin5.acl file. Verify if the name pattern you are using for the CM administrator will properly resolve to an administrative account.

[#3]

Anyone ?😐

[#4 · Accepted solution]

So as you read through the error message, (the middle here being signficant) this line appears to be indicating at least part of the problem, as well as the others like it, that follow.

add_principal: Operation requires ``add'' privilege while creating "yarn/[email protected]".

You would want to review your /var/kerberos/krb5kdc/kadmin5.acl file. Verify if the name pattern you are using for the CM administrator will properly resolve to an administrative account.

[#5]

Hi,
The problem was indeed the kadm5.acl file where I had a typo in the realm name.

Thank you!

[#6]

There are a few files to change for realm renaming.

[#7]

Hi all,

when enable Kerberos on new cluster after restart the failed installation got the error message 

Generate Missing Credentials Command

/usr/share/cmf/bin/gen_credentials.sh failed with exit code 1 and output of <<
+ export PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/usr/lib/mit/bin:/usr/bin:/sbin:/usr/sbin:/bin:/usr/bin
+ PATH=/usr/kerberos/bin:/usr/kerberos/sbin:/usr/lib/mit/sbin:/usr/sbin:/usr/lib/mit/bin:/usr/bin:/sbin:/usr/sbin:/bin:/usr/bin
+ CMF_REALM=HADM.RU
+ KEYTAB_OUT=/var/run/cloudera-scm-server/cmf5888901524077791261.keytab
+ PRINC=mapred/[email protected]
+ MAX_RENEW_LIFE=604800
+ KADMIN='kadmin -k -t /var/run/cloudera-scm-server/cmf5922922234613877041.keytab -p cloudera-scm/[email protected] -r HADM.RU'
+ RENEW_ARG=
+ '[' 604800 -gt 0 ']'
+ RENEW_ARG='-maxrenewlife "604800 sec"'
+ '[' -z /etc/krb5.conf ']'
+ echo 'Using custom config path '\''/etc/krb5.conf'\'', contents below:'
+ cat /etc/krb5.conf
+ kadmin -k -t /var/run/cloudera-scm-server/cmf5922922234613877041.keytab -p cloudera-scm/[email protected] -r HADM.RU -q 'addprinc -maxrenewlife "604800 sec" -randkey mapred/[email protected]'
WARNING: no policy specified for mapred/[email protected]; defaulting to no policy
add_principal: Principal or policy already exists while creating "mapred/[email protected]".
+ '[' 604800 -gt 0 ']'
++ kadmin -k -t /var/run/cloudera-scm-server/cmf5922922234613877041.keytab -p cloudera-scm/[email protected] -r HADM.RU -q 'getprinc -terse mapred/[email protected]'
++ tail -1
++ cut -f 12
+ RENEW_LIFETIME=0
+ '[' 0 -eq 0 ']'
+ echo 'Unable to set maxrenewlife'
+ exit 1

>>

Close

Redhat 7.5 linux   Cloudera Manager 5.12.1

[#8 · Accepted solution]

@techfriend this can be resolved after modifiying the principle.

WARNING: no policy specified for mapred/[email protected]; defaulting to no policy
add_principal: Principal or policy already exists while creating "mapred/[email protected]".
+ '[' 604800 -gt 0 ']'
++ kadmin -k -t /var/run/cloudera-scm-server/cmf5922922234613877041.keytab -p cloudera-scm/[email protected] -r HADM.RU -q 'getprinc -terse mapred/[email protected]'
++ tail -1
++ cut -f 12
+ RENEW_LIFETIME=0
+ '[' 0 -eq 0 ']'
+ echo 'Unable to set maxrenewlife'
+ exit 1

Login to kadmin.local shell then modify the principle using below comamnd.

kadmin.local

modprinc -maxrenewlife 90day +allow_renewable mapred/[email protected]

[#9]

@techfriend this can be resolved after modifiying the principle.

WARNING: no policy specified for mapred/[email protected]; defaulting to no policy
add_principal: Principal or policy already exists while creating "mapred/[email protected]".
+ '[' 604800 -gt 0 ']'
++ kadmin -k -t /var/run/cloudera-scm-server/cmf5922922234613877041.keytab -p cloudera-scm/[email protected] -r HADM.RU -q 'getprinc -terse mapred/[email protected]'
++ tail -1
++ cut -f 12
+ RENEW_LIFETIME=0
+ '[' 0 -eq 0 ']'
+ echo 'Unable to set maxrenewlife'
+ exit 1

modprinc -maxrenewlife 90day +allow_renewable mapred/[email protected]