Kerberos principal should have 3 parts: hive

[#1]

not able to start metastore....it is kerborized using Ambari, version 2.5.3

[hive@master2 ~]$ klist

klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_501)

[hive@master2 ~]$ kinit -k -t /etc/security/keytabs/hive.service.keytab hive/[email protected] [hive@master2 ~]$ klist

Ticket cache: FILE:/tmp/krb5cc_501

Default principal: hive/[email protected]

Valid starting Expires Service principal

02/03/17 14:55:41 02/04/17 14:55:41 krbtgt/[email protected]

renew until 02/03/17 14:55:41

[hive@master2 ~]$

[#2]

@Raja Sekhar Chintalapati

Can you share log information from the moment you try to start the metastore?

Also the output of --> klist -kte /etc/security/keytabs/hive.service.keytab

[#3]

@icocio

[hive@master2 ~]$ klist -kte /etc/security/keytabs/hive.service.keytab Keytab name: FILE:/etc/security/keytabs/hive.service.keytab KVNO Timestamp Principal ---- ----------------- -------------------------------------------------------- 2 02/03/17 15:12:29 hive/[email protected] (arcfour-hmac) 2 02/03/17 15:12:29 hive/[email protected] (des-cbc-md5) 2 02/03/17 15:12:29 hive/[email protected] (aes256-cts-hmac-sha1-96) 2 02/03/17 15:12:29 hive/[email protected] (aes128-cts-hmac-sha1-96) 2 02/03/17 15:12:29 hive/[email protected] (des3-cbc-sha1) [hive@master2 ~]$

[#4]

Feb 03 15:23:55 master2.chrsv.com krb5kdc[3363](info): TGS_REQ (4 etypes {18 17 16 23}) 192.168.56.21: ISSUE: authtime 1486153210, etypes {rep=18 tkt=18 ses=18}, nn/[email protected] for nn/[email protected] Feb 03 15:24:00 master2.chrsv.com krb5kdc[3363](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.56.63: ISSUE: authtime 1486153440, etypes {rep=18 tkt=18 ses=18}, [email protected] for krbtgt/[email protected] Feb 03 15:24:08 master2.chrsv.com krb5kdc[3363](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.56.22: ISSUE: authtime 1486153448, etypes {rep=18 tkt=18 ses=18}, [email protected] for krbtgt/[email protected] Feb 03 15:24:12 master2.chrsv.com krb5kdc[3363](info): TGS_REQ (4 etypes {18 17 16 23}) 192.168.56.22: ISSUE: authtime 1486153222, etypes {rep=18 tkt=18 ses=18}, nn/[email protected] for HTTP/[email protected]

I see services but not hive in krb5.log

[#5]

@Raja Sekhar Chintalapati

Can you share the hivemetastore log? Kerberos principal should have 3 parts would mean that kerberos principal provided for auth is incomplete ,this can happen if you have provided principal like hive/master2.chrsv.com(excluding REALM name) If you are trying to start from Ambari then you should see output.log and error.log from here we can see which principal is being used while starting the service and correct it in config according to that error.

[#6 · Accepted solution]

this is because mysql is external to ambari and when kerberos is enabled ambari is not smart enough to recognize mysql and it didnot create keytabs for mysql. that was the reason hive was not able to start.

i still need to find out a way to create keytabs for non ambari components. as of now i moved these components to another server where all the services were deployed through ambari.

thanks to all for your help so far.

[#7]

Hello

Having the same issue 😞

I find in the hive meta store log

2017-03-10 16:50:52,164 INFO  [main]: zookeeper.ZooKeeper (Environment.java:logEnv(100)) - Client environment:user.name=hive

No idea where this is coming from though

All tips appreciated!

Peter