1189 [main] INFO o.a.s.StormSubmitter - Running org.apache.storm.security.auth.kerberos.AutoTGT@129b4fe2 Exception in thread "main" java.lang.RuntimeException: java.lang.RuntimeException: The TGT found is not renewable at org.apache.storm.security.auth.kerberos.AutoTGT.populateCredentials(AutoTGT.java:103) at org.apache.storm.StormSubmitter.populateCredentials(StormSubmitter.java:94) at org.apache.storm.StormSubmitter.submitTopologyAs(StormSubmitter.java:214) at org.apache.storm.StormSubmitter.submitTopology(StormSubmitter.java:310) at org.apache.storm.StormSubmitter.submitTopology(StormSubmitter.java:157) at storm.starter.WordCountTopology.main(WordCountTopology.java:77) Caused by: java.lang.RuntimeException: The TGT found is not renewable at org.apache.storm.security.auth.kerberos.AutoTGT.populateCredentials(AutoTGT.java:94)... 5 more
When we check the Keberos Principal which as R Flag as well.
We tried even regenerating the keytabs, this problem is not resolved.
When we submit from new keytab principal, this is working fine.Can you please suggest, is there anyway we can avoid this TGT Renewal check or how to resolve. OS version : Red Hat Enterprise Linux Server release 7.4 (Maipo) Problematic principal details :
[storm@cbro-test-stm1 ~]$ klist -f
Ticket cache: FILE:/tmp/krb5cc_1024 Default principal: metron@XXXXXX.COM Valid starting Expires Service principal 01/09/2018 15:28:47 01/10/2018 01:28:47 krbtgt/XXXXXX.COM@XXXXXX.COM renew until 01/16/2018 15:28:47, Flags: FRIA
I am not 100% sure, but I believe a Kerberos ticket must be renewed before it is expired. So once it has already been expired, you must get a new ticket instead of renewing it.
This basically happens because the current ticket is used as the authentication to get the renewed ticket. And the renewed ticket can only have the maximum expiration of the time given in 'renew until'. So different to what you might believe 'renew until' does not give you the time until you can renew a ticket, but the maximum live time for the renewed ticket.