Kerberos local KDC - Error 401 Authentication required

[#1]

This is the Ambari error we receive when we attempt to restart the services.

raise Fail(err_msg) 
resource_management.core.exceptions.Fail: Execution of 'curl -sS -L -w '%{http_code}' -X GET --negotiate -u : 'http://devehdp001.unix.xxxx1900.org:50070/webhdfs/v1/user/hcat?op=GETFILESTATUS&user.name=hdfs'' returned status_code=401. 
<html> 
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/> 
<title>Error 401 Authentication required</title> 
</head> 
<body><h2>HTTP ERROR 401</h2> 
<p>Problem accessing /webhdfs/v1/user/hcat. Reason: 
<pre> Authentication required</pre></p><hr /><i><small>Powered by Jetty://</small></i><br/> 

[#2]

@[email protected]

What's ambari version?

If you are on Ambari < 2.0.0 then you may want to see this

[#3 · Accepted solution]

This is an authentication error that occurs when an HTTP request lacks a Kerberos ticket while the server requires it. So some service is not properly configured or a kinit is failing prior to executing this webhdfs call.

The service that is failing needs to be identified. Then you need to take a look at how it is configured and make sure a kinit can be successfully executed (manually) using the relevant Kerberos principal and keytab file. The kinit may fail because the keytab file is out of sync with the KDC or the service is misconfigured to use an incorrect principal name or keytab file.