Support Questions
Find answers, ask questions, and share your expertise

What is correct strategy for hbase Kerberos Login For Long running applications?

Explorer

We run hbase client in long running application in kerberized cluster.

We login to hadoop and hbase using UserGroupInformation class.

Also, we launch as background thread to relogin.

However , this code does not work with versions of hbase-client ( 0.98-4-hadoop2 and hadoop-common 2.6.0).

Is there a better way to perform kerberos login usinf keytab and taking care of ticket expiry.

1 ACCEPTED SOLUTION

Accepted Solutions

Arvind, you may be using a combination of Hadoop & JDK that doesn't support keytab renewal. The later versions of Hadoop 2.6 (that's apache 2.6.2+ and HDP 2.2 maintenance releases) should work.

View solution in original post

6 REPLIES 6

@Arvind K Jajoo This code looks reasonable. Can you please elaborate what does not work with 0.98.4?

Explorer

After every 30 minutes when thread enters into checkTGTAndReloginFromKeytab method it must relogin after 8 hours since our kerberos expiry is 10 hours but it does not relogin.

What version of Java are you using? I ask as some changes in Java 1.7 stopped ticket renewal in Hadoop 2.6.0/HDP2.2.0; it's been fixed in later Hadoop releases (2.6.2?) and later versions of HDP2.2+

Explorer

Ohh, we are using Java 1.7 and Hadoop 2.6 release .

Arvind, you may be using a combination of Hadoop & JDK that doesn't support keytab renewal. The later versions of Hadoop 2.6 (that's apache 2.6.2+ and HDP 2.2 maintenance releases) should work.

View solution in original post

BTW, if you try that login & renew at startup, you should be able to fail fast and not wait so long to find out things aren't working.