Oozie job failing due to Kerberos error

[#1]

Oozie java action is failing with below error. We have tried passing credentials from oozie as well as principal,keytab based authentication from driver using below config.

conf.set("hadoop.security.authentication", "kerberos");
conf.set("java.security.krb5.conf", "/etc/krb5.conf");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("principal", "keytab");

Failing Oozie Launcher, Main class [org.apache.oozie.action.hadoop.JavaMain], main() threw exception, java.io.IOException: Can't get Master Kerberos principal for use as renewer
org.apache.oozie.action.hadoop.JavaMainException: java.io.IOException: Can't get Master Kerberos principal for use as renewer
at org.apache.oozie.action.hadoop.JavaMain.run(JavaMain.java:58)
at org.apache.oozie.action.hadoop.LauncherMain.run(LauncherMain.java:39)
at org.apache.oozie.action.hadoop.JavaMain.main(JavaMain.java:36)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.oozie.action.hadoop.LauncherMapper.map(LauncherMapper.java:226)
at org.apache.hadoop.mapred.MapRunner.run(MapRunner.java:54)
at org.apache.hadoop.mapred.MapTask.runOldMapper(MapTask.java:450)
at org.apache.hadoop.mapred.MapTask.run(MapTask.java:343)

[#2]

If you are using Yarn, the Yarn gateway roles need to be provided to the workflow.

[#3]

how to provide Yarn gateway roles to the workflow ?

[#4 · Accepted solution]

Adding HADOOP_TOKEN_FILE_LOCATION resolved the issue.

-D mapreduce.job.credentials.binary=$HADOOP_TOKEN_FILE_LOCATION

[#5]

Did you have to keep below as well?

1. conf.set("hadoop.security.authentication","kerberos");
2. conf.set("java.security.krb5.conf","/etc/krb5.conf");
3. UserGroupInformation.setConfiguration(conf);
4. UserGroupInformation.loginUserFromKeytab("principal","keytab");