user not found while running hive query from kerberos user

[#1]

Hi Folks,

I have 3 node cluster in my environment, where i have configured kerberos & ranger integrated with Active Directory. I have setup one way trust MIT KDC. Users are able to get ticket.

Now while i'm running hive query, i'm getting failed query and getting below logs:

Application application_1528875723692_0001 failed 2 times due to AM Container for appattempt_1528875723692_0001_000002 exited with exitCode: -1000

For more detailed output, check the application tracking page: http://security-test3.example.com:8088/cluster/app/application_1528875723692_0001

Then click on links to logs of each attempt.

Diagnostics: Application application_1528875723692_0001 initialization failed (exitCode=255) with output: main : command provided 0

main : run as user is asif

main : requested yarn user is asif

User asif not found

Failing this attempt. Failing the application.

Please advice what can i do for solve it.

Regards,

Vinay

[#2 · Accepted solution]

Hey @Vinay K!

Does this user asif exists in all NodeManager/ResourceManager machines? And does it belong to yarn group?

Hope this helps!

[#3 · Accepted solution]

Hey @Vinay K!

Does this user asif exists in all NodeManager/ResourceManager machines? And does it belong to yarn group?

Hope this helps!

[#4]

Hi @Vinicius Higa Murakami

No, asif user does not exist on any Nodemanager/ResourceManager machines. I had setup-ldap(AD) with ambari-server. Then i had setup one way trust MIT KDC with AD. I believe i don't need to setup sssd service.

I have defined asif user in ranger policy for use all queue.

Even i had tried to add user on OS of ResourceManeger, i was able to execute query by asif. But i don't want to add each user on ResourceManager's OS.

[#5 · Accepted solution]

Hi,

I have configured the sssd with AD server.

Now i'm able to run query.

Thanks

Let me know if anyone having any query.

[#6]

Hi, vinayk

i have the same issue as yours, integrated hadoop with openldap, and hdfs, hive, sentry can work fine, i mean sentry or hdfs can find user in openldap.  but the only exceptional is yarn can't , when i test mapreduce examples by the user which is exist in openldap, it gives me the errors like below:

main : run as user is jialong
main : requested yarn user is jialong
User jialong not found

as you know, when we create this user on os level , it will be ok , but i don't want to create user on os level, how to achieve that ? why hdfs. sentry can work fine, but yarn is not .

[#7]

@iamfromsky as this is an older post, you would have a better chance of receiving a resolution by starting a new thread. This will also be an opportunity to provide details specific to your environment that could aid others in assisting you with a more accurate answer to your question. You can link this thread as a reference in your new post.