Impala3.4 with kerberos auth, impala-shell get wrong principal

[#1]

Impala 3.4

When impala-shell is started, impalad.ERROR:

authentication.cc:177] SASL message (Kerberos (external)): GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No key table entry found for impala@node1)

I don't understand why it got the wrong principal. I passed in the correct principal and keytab in the startup file.

Can someone help me? Thank you very much.

[#2]

Hi,

Can you regenerate the kerberos credentials for impala from CM and see if it helps?

Regards,

Chethan YM

[#3]

Thank you for the attention, I try to regenerate the Kerberos credentials but get the same result. Enable impala in Ambari

[#4]

@ken_zz ,

Please run the following command to list the principals contained in your keytab:

klist -kt <keytab_file>

The full principal name is the long form: either username@REALM or username/fqdn@REALM.

Try specifying the full principal name when starting impala-shell.

Cheers,

André

[#5]

Thank you for the attention, the Principal name is complete and correct.

Impala Catalog and Impala Server will report an error:

9236 authentication.cc:177] SASL message (Kerberos (internal)): GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server krbtgt/statestore_hostname@TEST.COM not found in Kerberos database)

When I set "-skip_internal_kerberos_auth=true", only Coordinator gets this error.

When I set "-skip_internal_kerberos_auth=true" and "-skip_external_kerberos_auth=true", all components are fine, but then Kerberos authentication is lost.