NameNode and Yarn and Storm and HBase UI Cannot Accessed.

[#1]

@Zhao Chaofeng

Looks like your Browser side kerberos configuration is not done properly. Like setting "network.negotiate-auth.trusted-uris" in Firefox? And Enabled firefox to use native gsslib for authentication.

- Just to validate the same, can you try the same from Non Browser environment (Terminal) to see if it works.

klist -kt /etc/security/keytabs/spnego.service.keytab
kinit -kt /etc/security/keytabs/spnego.service.keytab <Principal> 
klist 
curl --negotiate -u:<anyuser> "http://$<Host_Name>:$<Port>/webhdfs/v1/user/?op=LISTSTATUS"

.

[#2]

root@bigdata013 ~]# klist -kt /etc/security/keytabs/spnego.service.keytab Keytab name: FILE:/etc/security/keytabs/spnego.service.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 1 2017-01-05T15:38:34 HTTP/bigdata013.example.com@EXAMPLE.COM 1 2017-01-05T15:38:34 HTTP/bigdata013.example.com@EXAMPLE.COM 1 2017-01-05T15:38:34 HTTP/bigdata013.example.com@EXAMPLE.COM 1 2017-01-05T15:38:34 HTTP/bigdata013.example.com@EXAMPLE.COM 1 2017-01-05T15:38:34 HTTP/bigdata013.example.com@EXAMPLE.COM [root@bigdata013 ~]# kinit -kt /etc/security/keytabs/spnego.service.keytab admin/admin@EXAMPLE.COM kinit: Keytab contains no suitable keys for admin/admin@EXAMPLE.COM while getting initial credentials [root@bigdata013 ~]# kinit -kt /etc/security/keytabs/spnego.service.keytab HTTP/bigdata013.example.com@EXAMPLE.COM [root@bigdata013 ~]# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: HTTP/bigdata013.example.com@EXAMPLE.COM Valid starting Expires Service principal 2017-01-05T15:58:59 2017-01-06T15:58:59 krbtgt/EXAMPLE.COM@EXAMPLE.COM [root@bigdata013 ~]# curl --negotiate -u:<anyuser> "http://bigdata013.example.com:50070/webhdfs/v1/user/?op=LISTSTATUS"" > ^C [root@bigdata013 ~]# curl --negotiate -u:<anyuser> "http://bigdata013.example.com:50070/webhdfs/v1/user/?op=LISTSTATUS" -bash: anyuser: No such file or directory [root@bigdata013 ~]# curl --negotiate -u:hdfs "http://bigdata013.example.com:50070/webhdfs/v1/user/?op=LISTSTATUS" {"FileStatuses":{"FileStatus":[ {"accessTime":0,"blockSize":0,"childrenNum":0,"fileId":16388,"group":"hdfs","length":0,"modificationTime":1483600754705,"owner":"ambari-qa","pathSuffix":"ambari-qa","permission":"770","replication":0,"storagePolicy":0,"type":"DIRECTORY"} ]}}

Hi, above is the result.

[#3]

@Zhao Chaofeng

As through command line using the "--negotiate" option you are able to access the same "webhdfs", So this is god enough to isolate the issue. Your browser needs to be setup with the negotiation as mentioned earlier Like setting "network.negotiate-auth.trusted-uris" in Firefox?

[#4]

Yes, I configure it in firefox, but it response:

HTTP ERROR 403
Problem accessing /index.html. Reason: 
    GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
Powered by Jetty://

[#5]

@Zhao Chaofeng

1. In your Browser (firefox) config "about:config" seacch for the property "network.auth.use-sspi" and change the property to "false".

2. Also please check if network.negotiate-auth.delegation-uris and network.negotiate-auth.trusted-uris set to correct domain.

.

[#6]

My operation system is Ubuntu. I follow your step, but my firefox return resutl is

HTTP ERROR 401

Problem accessing /index.html. Reason:

    Authentication required

---

Powered by Jetty://

[#7]

@Zhao Chaofeng

Were you able to solve this. I am facing the same problem in firefox.