What is correct strategy for hbase Kerberos Login For Long running applications?

[#1]

We run hbase client in long running application in kerberized cluster.

We login to hadoop and hbase using UserGroupInformation class.

Also, we launch as background thread to relogin.

However , this code does not work with versions of hbase-client ( 0.98-4-hadoop2 and hadoop-common 2.6.0).

Is there a better way to perform kerberos login usinf keytab and taking care of ticket expiry.

[#2]

@Arvind K Jajoo This code looks reasonable. Can you please elaborate what does not work with 0.98.4?

[#3]

After every 30 minutes when thread enters into checkTGTAndReloginFromKeytab method it must relogin after 8 hours since our kerberos expiry is 10 hours but it does not relogin.

[#4]

What version of Java are you using? I ask as some changes in Java 1.7 stopped ticket renewal in Hadoop 2.6.0/HDP2.2.0; it's been fixed in later Hadoop releases (2.6.2?) and later versions of HDP2.2+

[#5]

Ohh, we are using Java 1.7 and Hadoop 2.6 release .

[#6 · Accepted solution]

Arvind, you may be using a combination of Hadoop & JDK that doesn't support keytab renewal. The later versions of Hadoop 2.6 (that's apache 2.6.2+ and HDP 2.2 maintenance releases) should work.

[#7]

BTW, if you try that login & renew at startup, you should be able to fail fast and not wait so long to find out things aren't working.