Support Questions
Find answers, ask questions, and share your expertise

Why I'm able to access the hdfs even after kerberos ticket is expired.

Rising Star

I've modified the principal maxlife to 5min, as per the theory I should not be able to access the hdfs after 5min. But for me ticket is expiring after 10min. Any idea?

WARN ipc.Client: Exception encountered while connecting to the server : 
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] 

modified maxlife using below command,

modprinc -maxlife "5minutes" hdfs-n@HWXBLR.COM
1 ACCEPTED SOLUTION

Accepted Solutions

Rising Star

The default value for maximum clock skew is 300 seconds, or five minutes. So by default, the kerberos server will refuse to issue tickets only if the clocks are out of sync by more than 5 minutes, hence you are allowed to access the service or renew tickets till the acceptable clock skew time. MIT ClockSkew

View solution in original post

3 REPLIES 3

Rising Star

The default value for maximum clock skew is 300 seconds, or five minutes. So by default, the kerberos server will refuse to issue tickets only if the clocks are out of sync by more than 5 minutes, hence you are allowed to access the service or renew tickets till the acceptable clock skew time. MIT ClockSkew

View solution in original post

Rising Star

thanks @krajguru for response. So it is expected behavior. Can we reduce this clock skew and is it advised to reduce it?

Rising Star

@nyadav You can change this default value of 300 seconds in the [libdefaults] section of the krb5.conf file. But for security reasons, do not increase the clock skew beyond 300 seconds.