Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Mapreduce job can't talk with Hbase on a kerberos enabled CDH cluster

Mapreduce job can't talk with Hbase on a kerberos enabled CDH cluster

Explorer

Hi, 

I am writing a mapreduce application to access Hbase data on a CDH cluster with kerberos enable. Now, I face a a issue, hope someone can help: 

 

My mapreduce code: 

conf.set("hadoop.security.authentication", "Kerberos");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("jj@example.com", "jj.keytab");
HTable table = new HTable(conf, "myTable");
Put p = new Put(Bytes.toBytes("myLittleRow"));
p.add(Bytes.toBytes("myColumnFamily"), Bytes.toBytes("someQualifier"),
Bytes.toBytes("Some Value"));
table.put(p);

 

This above code help me to run in local mode successfully with java -jar or hadoop -jar. But when I try to run with a hue-ozzie work flow, the issue now happen: 

 FATAL [main] org.apache.hadoop.hbase.ipc.RpcClientImpl: SASL authentication failed. The most likely cause is missing or invalid credentials. Consider 'kinit'.
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)

 

So, I try to use init credentials to obtain valid token to run the job  

TableMapReduceUtil.initCredentialsForCluster(job,conf);

 

But the issue still happen. Do someone have any idea? 

My CDH version is 5.9.0, run on 3 nodes and kerberos version is 1.10.1

2 REPLIES 2

Re: Mapreduce job can't talk with Hbase on a kerberos enabled CDH cluster

Champion

@ducna

 

Is the jj.keytab belongs to any specific user? Pls check that you have a dedicated keytab for Oozie... Ex:  oozie.keytab and use it instead of jj.keytab

 

 

Highlighted

Re: Mapreduce job can't talk with Hbase on a kerberos enabled CDH cluster

Explorer

Finally i found the solution. It's easy to configure a hue-ozzie job on CDH to talk with a secure Hbase. All I need is enable Hbase credential when setup work flow and add hbase-site.xml to job.xml path.

Don't have an account?
Coming from Hortonworks? Activate your account here