Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Solved Go to solution

Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

HDP version : 2.3.0 Ambari version: 2.1.0

Enabled Kerberos with Windows Active Directory (not cross-realm) from Ambari.

Confirmed kinit and curl to WebHDFS worked with an AD user.

Followed http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.2.0/bk_Ambari_Security_Guide/content/_configurin...

Again, confirmed kdestroy & kinit and curl to WebHDFS and NameNode UI worked with an AD user.

Now, tried to access HDP NameNode UI page from Firefox on Windows PC.

Copied /etc/krb5.conf to C:\Windows\krb5.ini.
Followed some instruction found on internet to set up Firefox.
And didn't work. The error was "GSSHeader did not find the right tag"

For troubleshooting purpose, downloaded curl.exe from http://curl.haxx.se/download.html

Trying to access HDP, for example, NameNode:50070 with curl --negotiate, and got same error "GSSHeader did not find the right tag"

Copied "/etc/security/keytabs/spnego.service.keytab" into Windows and did kinit -k -t and curl --negotiate but same error.

Does anyone know what would be missing to make Windows PC work to access secured web page?

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

You're probably running into the latest JDK/Kerberos issue.

What JDK Version do you have? 1.8.0_40?

The JDK 1.8.0_40 has a bug and throws the following error:

GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
The token supplied by the client is not accepted by the server.

This is because Windows sends an NTLM based ticket not a kerberos based ticket.

I had this issue a couple weeks ago, it is fixed in 1.8.0_60, so the easiest way is to upgrade the JDK on your nodes.

View solution in original post

16 REPLIES 16
Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Have you tried to use another browser like Internet Explorer or Chrome? I understand that you tried curl as well as Firefox, but both may have issues on Windows.

What version of Windows are you using?

Does the user use that Active Directory to login to the Windows box or are you kinit-ing manually?

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

You're probably running into the latest JDK/Kerberos issue.

What JDK Version do you have? 1.8.0_40?

The JDK 1.8.0_40 has a bug and throws the following error:

GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
The token supplied by the client is not accepted by the server.

This is because Windows sends an NTLM based ticket not a kerberos based ticket.

I had this issue a couple weeks ago, it is fixed in 1.8.0_60, so the easiest way is to upgrade the JDK on your nodes.

View solution in original post

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Thanks for the official Oracle bug reference. I'll see if I can raise this internally and we can change the default/recommended JDK to 1.8.0_60 in our docs

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

@Hajime Thanks for sharing the bug details.

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Expert Contributor

@Jonas Straub

I am using jdk1.8.0_60 but still facing the same issue when accessing web UI's.

GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Expert Contributor

@Jonas Straub

Issue is now resolved. The issue was with kerberos ticket and not with JDK. Thanks!!!

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

New Contributor

Hello @Shyam Shaw, could you please teach me how did you resolved this issue? Thank you.

I've googled a lot and always get this error.

Highlighted

Re: Accessing HDP web UI from Windows PC causes "GSSHeader did not find the right tag"

Hey @Shyam Shaw, could you please help me with the solution for this problem ?

Don't have an account?
Coming from Hortonworks? Activate your account here