Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Oozie job failing due to Kerberos error

avatar
Expert Contributor

Oozie java action is failing with below error. We have tried passing credentials from oozie as well as principal,keytab based authentication from driver using below config.

conf.set("hadoop.security.authentication", "kerberos");
conf.set("java.security.krb5.conf", "/etc/krb5.conf");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("principal", "keytab");
Failing Oozie Launcher, Main class [org.apache.oozie.action.hadoop.JavaMain], main() threw exception, java.io.IOException: Can't get Master Kerberos principal for use as renewer
org.apache.oozie.action.hadoop.JavaMainException: java.io.IOException: Can't get Master Kerberos principal for use as renewer
at org.apache.oozie.action.hadoop.JavaMain.run(JavaMain.java:58)
at org.apache.oozie.action.hadoop.LauncherMain.run(LauncherMain.java:39)
at org.apache.oozie.action.hadoop.JavaMain.main(JavaMain.java:36)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.oozie.action.hadoop.LauncherMapper.map(LauncherMapper.java:226)
at org.apache.hadoop.mapred.MapRunner.run(MapRunner.java:54)
at org.apache.hadoop.mapred.MapTask.runOldMapper(MapTask.java:450)
at org.apache.hadoop.mapred.MapTask.run(MapTask.java:343)
1 ACCEPTED SOLUTION

avatar
Expert Contributor

Adding HADOOP_TOKEN_FILE_LOCATION resolved the issue.

-D mapreduce.job.credentials.binary=$HADOOP_TOKEN_FILE_LOCATION

View solution in original post

4 REPLIES 4

avatar
Rising Star

If you are using Yarn, the Yarn gateway roles need to be provided to the workflow.

avatar

how to provide Yarn gateway roles to the workflow ?

avatar
Expert Contributor

Adding HADOOP_TOKEN_FILE_LOCATION resolved the issue.

-D mapreduce.job.credentials.binary=$HADOOP_TOKEN_FILE_LOCATION

avatar

Did you have to keep below as well?

  1. conf.set("hadoop.security.authentication","kerberos");
  2. conf.set("java.security.krb5.conf","/etc/krb5.conf");
  3. UserGroupInformation.setConfiguration(conf);
  4. UserGroupInformation.loginUserFromKeytab("principal","keytab");