​MIT Kerberos client Ticket initialization failing to get ticket from HDP 2.6.4/Ambari Kerberized

[#1]

Hi,

I have HDP 2.6.4 sandbox, most of the services like HDFS, HIVE etc kerberized and test connection on Ranger also works. But using MIT Kerberos client on my Windows, get ticket is failing with an error "Ticket initialization failed. Kerberos 5: Cannot contact any KDC for requested realm(error -1765328228)".

I have provided Principal as "hive/sandbox-hdp.hortonworks.com@HDFSCLUSTER.COM" Using putty and ssh port 2222, I can see "172.17.0.2 sandbox-hdp.hortonworks.com sandbox-hdp" in /etc/hosts file. But this host sandbox-hdp.hortonworks.com as well as the ip 172.17.0.2 is not pingable from my Windows:

C:\Windows\System32>ping 172.17.0.2 Pinging 172.17.0.2 with 32 bytes of data:

Reply from 122.181.1.205: Destination host unreachable.

Reply from 122.181.1.205: Destination host unreachable.

Reply from 122.181.1.205: Destination host unreachable.

Request timed out.

I think the hostname in the principal is not pingable and hence failing to get the ticket. I am trying to troubleshoot this problem for the past couple of days. I am not sure what I am missing, anyone please help me.

Thanks ,

Tulasi

[#2]

@Tulasi Uppu

Are you using the IP address that you've seen via docker inspect? Try the ip visible via docker-machine ls
And also be sure to check that windows firewall isn't preventing your access 🙂

Let me know if that solves your issue or if you have more questions! If this has helped, please take a moment to login and mark this answer as accepted!

[#3]

@Jonathan Sneep

Thanks for the comment.

When I login using putty ssh port:22 I get an IP (/etc/hosts) and I am able to ping this IP.

But if I login using ssh port:2222, I get an another IP (/etc/hosts) 172.17.0.2 and this is not pingable.

I am not sure how HDP sandbox giving two different IPs. I also tried by changing the IP 172.17.0.2 to the working one but when I restart the system, then HDP reverting back to 172.17.0.2.

Any thoughts please share.

Thanks,

Tulasi

[#4]

There are indeed 2 addresses, the sandbox is Centos which has an IP, and in centos there is a docker image running HDP which has another IP. From windows itself, ports on the docker image are forwarded and accessible via localhost. Ex when your sandox is up, you could access 127.0.0.1:8888 via a browser. Similarly port 2222 should also be forwarded to be accessible through localhost/127.0.0.1.