Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Why I'm able to access the hdfs even after kerberos ticket is expired.

Solved Go to solution

Why I'm able to access the hdfs even after kerberos ticket is expired.

Rising Star

I've modified the principal maxlife to 5min, as per the theory I should not be able to access the hdfs after 5min. But for me ticket is expiring after 10min. Any idea?

WARN ipc.Client: Exception encountered while connecting to the server : 
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] 

modified maxlife using below command,

modprinc -maxlife "5minutes" hdfs-n@HWXBLR.COM
1 ACCEPTED SOLUTION

Accepted Solutions

Re: Why I'm able to access the hdfs even after kerberos ticket is expired.

Rising Star

The default value for maximum clock skew is 300 seconds, or five minutes. So by default, the kerberos server will refuse to issue tickets only if the clocks are out of sync by more than 5 minutes, hence you are allowed to access the service or renew tickets till the acceptable clock skew time. MIT ClockSkew

3 REPLIES 3

Re: Why I'm able to access the hdfs even after kerberos ticket is expired.

Rising Star

The default value for maximum clock skew is 300 seconds, or five minutes. So by default, the kerberos server will refuse to issue tickets only if the clocks are out of sync by more than 5 minutes, hence you are allowed to access the service or renew tickets till the acceptable clock skew time. MIT ClockSkew

Re: Why I'm able to access the hdfs even after kerberos ticket is expired.

Rising Star

thanks @krajguru for response. So it is expected behavior. Can we reduce this clock skew and is it advised to reduce it?

Highlighted

Re: Why I'm able to access the hdfs even after kerberos ticket is expired.

Rising Star

@nyadav You can change this default value of 300 seconds in the [libdefaults] section of the krb5.conf file. But for security reasons, do not increase the clock skew beyond 300 seconds.