Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Kerberos local KDC - Error 401 Authentication required

avatar
New Contributor

This is the Ambari error we receive when we attempt to restart the services.

raise Fail(err_msg) 
resource_management.core.exceptions.Fail: Execution of 'curl -sS -L -w '%{http_code}' -X GET --negotiate -u : 'http://devehdp001.unix.xxxx1900.org:50070/webhdfs/v1/user/hcat?op=GETFILESTATUS&user.name=hdfs'' returned status_code=401. 
<html> 
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/> 
<title>Error 401 Authentication required</title> 
</head> 
<body><h2>HTTP ERROR 401</h2> 
<p>Problem accessing /webhdfs/v1/user/hcat. Reason: 
<pre> Authentication required</pre></p><hr /><i><small>Powered by Jetty://</small></i><br/> 
1 ACCEPTED SOLUTION

avatar

This is an authentication error that occurs when an HTTP request lacks a Kerberos ticket while the server requires it. So some service is not properly configured or a kinit is failing prior to executing this webhdfs call.

The service that is failing needs to be identified. Then you need to take a look at how it is configured and make sure a kinit can be successfully executed (manually) using the relevant Kerberos principal and keytab file. The kinit may fail because the keytab file is out of sync with the KDC or the service is misconfigured to use an incorrect principal name or keytab file.

View solution in original post

2 REPLIES 2

avatar
Master Mentor

@ddubeau@hortonworks.com

What's ambari version?

If you are on Ambari < 2.0.0 then you may want to see this

avatar

This is an authentication error that occurs when an HTTP request lacks a Kerberos ticket while the server requires it. So some service is not properly configured or a kinit is failing prior to executing this webhdfs call.

The service that is failing needs to be identified. Then you need to take a look at how it is configured and make sure a kinit can be successfully executed (manually) using the relevant Kerberos principal and keytab file. The kinit may fail because the keytab file is out of sync with the KDC or the service is misconfigured to use an incorrect principal name or keytab file.