Created on 02-22-201610:34 PM - edited on 02-12-202004:23 AM by VidyaSargur
Kerberos cross realm trust for distcp
This article is to demonstrate how to setup cross realm trust for distcp between two secure HDP clusters with their own Kerberos realms(KDC’s).
Prerequisites
Both HDP clusters must be running JDK 1.7 or higher. JDK 1.6 has some known issues
Lets assume first HDP DEV cluster realm : HDPDEV.DEV.COM
Lets assume second HDP QA cluster realm : HDPQA.QA.COM
Step 1 :
To set up cross realm trust between HDPDEV.DEV.COM and HDPQA.QA.COM, for example a client of realm HDPDEV.DEV.COM to access a service in realm HDPDQA.QA.COM, both realms must share a key for a principal name krbtgt/ HDPDQA.QA.COM@ HDPDEV.DEV.COM and both keys must have the same key version number associated with them.
Cross realm trust is unidirectional by default. So for clients in HDPQA.QA.COM also to have access services in HDPDEV.DEV.com, both realms must share a key for principal krbtgt/ HDPDDEV.DEV.COM@ HDPQA.QA.COM.
Note: On both clusters verify both entries have matching kvno and encryption types using kadmin.local : getprinc<principal_name>.
Step 2:
Next step is to set hadoop.security.auth_to_local parameter in both clusters. This parameter helps to map the principal to user. One issue here is that the SASL RPC client requires that the remote server’s Kerberos principal must match the server principal in its own configuration. Therefore, the same principal name must be assigned to the applicable NameNodes in the source and the destination cluster. For example, if the Kerberos principal name of the NameNode in the source cluster is nn/host1@HDPDDEV.DEV.COM, the Kerberos principal name of the NameNode in destination cluster must be nn/host2@HDPDQA.QA.COM, rather than nn2/host2@realm, for example
Configure complex trust relationships. There are two ways to do it. One way is to configure a shared hierarchy of names. This is the default and simple method. The other way is to explicitly change capaths section in krb5.conf file. This is complicated but more flexible.
Configure paths in krb5.conf :
Configure the capaths section of /etc/krb5.conf, so that clients which have credentials for one realm will be able to look up which realm is next in the chain which will eventually lead to the being able to authenticate to servers.
Edit the /etc/krb5.conf files on both clusters (all nodes) to map the domain to the realm.
For example,
In Dev Cluster :
[capaths]
HDPDDEV.DEV.COM ={
HDPDQA.QA.COM = .
}
In QA cluster:
[capaths]
HDPDQA.QA.COM = {
HDPDDEV.DEV.COM = .
}
The value “.” is used if there are no intermediate realms.
Step 4 :
Set dfs.namenode.kerberos.principal.patternparameter in hdfs-site.xml to *. This is a client-side RegEx that can be configured to control allowed realms to authenticate with.
If this parameter is not set,
java.io.IOException: Failed on local exception: java.io.IOException: java.lang.IllegalArgumentException: Server has invalid Kerberos principal: nn/hdm1.qa.com@HDP.DEV.COM; Host Details : local host is: "sdw1.dev.com/10.181.22.130"; destination host is: "hdm1.qa.com":8020;
Step 5 :
Test trust is setup by running hdfs commands from DEV cluster to QA cluster and vice versa.
Example:
On the DEV cluster, kinit userA@HDPDEV.DEV.COM and then issue hdfs commands:
After follow the exact steps which mentioned in this blog, I got below exception in ranger kms log and distcp job was failed.
org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No rules applied to hdfs-dev_cluster@BDPDEV.GE.NET
Added the same rules in advanced kms-site config under hadoop.kms.authentication.kerberos.name.rules property which we added in advanced hdfs core-site config. Now I am able to run the distcp job successfully.
