Support Questions
Find answers, ask questions, and share your expertise
Announcements
Check out our newest addition to the community, the Cloudera Innovation Accelerator group hub.

Oozie job failing due to Kerberos error

Rising Star

Oozie java action is failing with below error. We have tried passing credentials from oozie as well as principal,keytab based authentication from driver using below config.

conf.set("hadoop.security.authentication", "kerberos");
conf.set("java.security.krb5.conf", "/etc/krb5.conf");
UserGroupInformation.setConfiguration(conf);
UserGroupInformation.loginUserFromKeytab("principal", "keytab");
Failing Oozie Launcher, Main class [org.apache.oozie.action.hadoop.JavaMain], main() threw exception, java.io.IOException: Can't get Master Kerberos principal for use as renewer
org.apache.oozie.action.hadoop.JavaMainException: java.io.IOException: Can't get Master Kerberos principal for use as renewer
at org.apache.oozie.action.hadoop.JavaMain.run(JavaMain.java:58)
at org.apache.oozie.action.hadoop.LauncherMain.run(LauncherMain.java:39)
at org.apache.oozie.action.hadoop.JavaMain.main(JavaMain.java:36)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.oozie.action.hadoop.LauncherMapper.map(LauncherMapper.java:226)
at org.apache.hadoop.mapred.MapRunner.run(MapRunner.java:54)
at org.apache.hadoop.mapred.MapTask.runOldMapper(MapTask.java:450)
at org.apache.hadoop.mapred.MapTask.run(MapTask.java:343)
1 ACCEPTED SOLUTION

Rising Star

Adding HADOOP_TOKEN_FILE_LOCATION resolved the issue.

-D mapreduce.job.credentials.binary=$HADOOP_TOKEN_FILE_LOCATION

View solution in original post

4 REPLIES 4

Contributor

If you are using Yarn, the Yarn gateway roles need to be provided to the workflow.

how to provide Yarn gateway roles to the workflow ?

Rising Star

Adding HADOOP_TOKEN_FILE_LOCATION resolved the issue.

-D mapreduce.job.credentials.binary=$HADOOP_TOKEN_FILE_LOCATION

Did you have to keep below as well?

  1. conf.set("hadoop.security.authentication","kerberos");
  2. conf.set("java.security.krb5.conf","/etc/krb5.conf");
  3. UserGroupInformation.setConfiguration(conf);
  4. UserGroupInformation.loginUserFromKeytab("principal","keytab");