Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Upon enabling kerberos, Zookeeper doesn't start

avatar
Expert Contributor

On Sandbox 2.6.4 I am trying to enable kerberos with existing MS AD 2012R2. I hardly managed to enable it with minor issues and warnings.

java.io.IOException: Could not configure server because SASL configuration did not allow the  ZooKeeper server to authenticate itself properly: javax.security.auth.login.LoginException: Clock skew too great (37)

Following this I synced Sandbox and Server 2012R2. The tried again. But Zookeeper doesn't start with the same error.

5 REPLIES 5

avatar
Master Mentor

@Erkan ŞİRİN

You issue looks the NTPD service ie The clock on you system (Linux/UNIX) is too far off from the correct time or not in sync wit the AD 2012R".

Your machine needs to be within less than 5 minutes of the Kerberos servers in order to get any tickets.

avatar
Expert Contributor

Thank you @Geoffrey Shelton Okot for your quick answer. You are right there was huge difference between LDAP server and Sandbox. I am aware of that. But I have fixed it and retried but the result is the same.

[root@sandbox-hdp ~]# service ntpd status
ntpd (pid  29267) is running...
[root@sandbox-hdp ~]# date
Wed May  9 09:44:22 +03 2018

windows-saati.png

avatar
Master Mentor

@Erkan ŞİRİN

Can you repost the latest error ! And how I can reproduce it

avatar
Expert Contributor
Traceback (most recent call last):
  File "/var/lib/ambari-agent/cache/common-services/ZOOKEEPER/3.4.5/package/scripts/zookeeper_server.py", line 134, in <module>
    ZookeeperServer().execute()
  File "/usr/lib/python2.6/site-packages/resource_management/libraries/script/script.py", line 375, in execute
    method(env)
  File "/usr/lib/python2.6/site-packages/resource_management/libraries/script/script.py", line 978, in restart
    self.start(env, upgrade_type=upgrade_type)
  File "/var/lib/ambari-agent/cache/common-services/ZOOKEEPER/3.4.5/package/scripts/zookeeper_server.py", line 56, in start
    zookeeper_service(action='start', upgrade_type=upgrade_type)
  File "/usr/lib/python2.6/site-packages/ambari_commons/os_family_impl.py", line 89, in thunk
    return fn(*args, **kwargs)
  File "/var/lib/ambari-agent/cache/common-services/ZOOKEEPER/3.4.5/package/scripts/zookeeper_service.py", line 51, in zookeeper_service
    user=params.smokeuser
  File "/usr/lib/python2.6/site-packages/resource_management/core/base.py", line 166, in __init__
    self.env.run()
  File "/usr/lib/python2.6/site-packages/resource_management/core/environment.py", line 160, in run
    self.run_action(resource, action)
  File "/usr/lib/python2.6/site-packages/resource_management/core/environment.py", line 124, in run_action
    provider_action()
  File "/usr/lib/python2.6/site-packages/resource_management/core/providers/system.py", line 262, in action_run
    tries=self.resource.tries, try_sleep=self.resource.try_sleep)
  File "/usr/lib/python2.6/site-packages/resource_management/core/shell.py", line 72, in inner
    result = function(command, **kwargs)
  File "/usr/lib/python2.6/site-packages/resource_management/core/shell.py", line 102, in checked_call
    tries=tries, try_sleep=try_sleep, timeout_kill_strategy=timeout_kill_strategy)
  File "/usr/lib/python2.6/site-packages/resource_management/core/shell.py", line 150, in _call_wrapper
    result = _call(command, **kwargs_copy)
  File "/usr/lib/python2.6/site-packages/resource_management/core/shell.py", line 303, in _call
    raise ExecutionFailed(err_msg, code, out, err)
resource_management.core.exceptions.ExecutionFailed: Execution of '/usr/bin/kinit -kt /etc/security/keytabs/smokeuser.headless.keytab ambari-qa-sandbox@HADOOP.COM;' returned 1. kinit: Clock skew too great while getting initial credentials

On Virtulabox+Sandbox 2.6.4

Enable kerberos

Ambari force you to stop all services

When starting all services Zookeeper gives error shown above.

Thank you @Geoffrey Shelton Okot good luck.

avatar
Master Mentor

@Erkan ŞİRİN

Seeing your error above "kinit: Clock skew too great while getting initial credentials"

Correct me if I am wrong I see on your sandbox date output translates to date 09/05/2018 and time 09:44

# date
Wed May 9 09:44:22 +03 2018

But on the screenshot of your Windows time attached translates to date 02/05/2018 and the time 09:44 that's is 7 days difference

Please set your Windows 2012R2's date to the same date like the Sandbox its should work!!

Please let me know