Ambari server start failed due to Error Ambari Server Kerberos credentials check failed

[#1]

Hi All,

I am receiving error "Ambari Server Kerberos credentials check failed" when I try to start Ambari server. My settings are good in the file/etc/ambari-server/conf/krb5JAASLogin.conf. when I am trying to kinit it is giving error" kinit: Preauthentication failed while getting initial credentials".

Please be informed that we are using Active directory for authentication.

Please let me know what to do.

Thanks

[#2]

Have you tried to manually kinit as the identity declared in the JAAS config file to make sure it works? It is possible that the keytab file is out of sync with the password on the Active Directory.

Another possibly for the preauthentication error is that the host's clock is more then 5 minutes different than the clock on the Active Directory server.

[#3]

Have you tried to manually kinit as the identity declared in the JAAS config file to make sure it works? It is possible that the keytab file is out of sync with the password on the Active Directory.

Another possibly for the preauthentication error is that the host's clock is more then 5 minutes different than the clock on the Active Directory server.

[#4]

Hi Robert, Thanks for prompt reply.

yes I have tried KINIT manually but it is giving error "kinit: Preauthentication failed while getting initial credentials".

I have checked the time on AD and the ambari server and they are same.

How can I make keytab file to sync with the password on the active directory? Please advise

Thanks

[#5]

So the keytab file is probably bad. How was it created? Did Ambari create it or was it created manually?

[#6]

Ambari created keytab.

[#7]

What is the principal name? Does it contain the cluster name? If not, are there multiple clusters using the same AD? If this is the case, than it is likely another cluster update the password for the Ambari server principal, invalidating the keytab file. To solve this, you need to make sure the cluster name (or some other unique name) is added to the Ambari server principal and regenerate the keytab files. This should fix the issue.