Support Questions

Find answers, ask questions, and share your expertise

impalad kerbeors - error Mechanism level: Failed to find any Kerberos tgt)]

avatar
Contributor

Hello All,

 

I think you guys may be knowing is reason for this issue. Could you please give me hand to get this resolved?

 

I get this error after getting kerberos configured by using cloudera manager.

 

Other components all working with kerberos and no issue within cluster.

 

Thanks,

Ram

 

 

 

W1115 09:26:01.391156 32586 Configuration.java:824] mapred.max.split.size is deprecated. Instead, use mapreduce.input.fileinputformat.split.maxsize
W1115 09:26:01.391850 32586 Configuration.java:824] mapred.min.split.size is deprecated. Instead, use mapreduce.input.fileinputformat.split.minsize
W1115 09:26:01.392773 32586 Configuration.java:824] mapred.min.split.size.per.rack is deprecated. Instead, use mapreduce.input.fileinputformat.split.minsize.per.rack
W1115 09:26:01.392869 32586 Configuration.java:824] mapred.min.split.size.per.node is deprecated. Instead, use mapreduce.input.fileinputformat.split.minsize.per.node
W1115 09:26:01.392962 32586 Configuration.java:824] mapred.reduce.tasks is deprecated. Instead, use mapreduce.job.reduces
W1115 09:26:01.393112 32586 Configuration.java:824] mapred.reduce.tasks.speculative.execution is deprecated. Instead, use mapreduce.reduce.speculative
W1115 09:26:01.513977 32586 Configuration.java:2038] org.apache.hadoop.hive.conf.LoopingByteArrayInputStream@6c63a721:an attempt to override final parameter: mapreduce.job.end-notification.max.retry.interval;  Ignoring.
W1115 09:26:01.522991 32586 Configuration.java:2038] org.apache.hadoop.hive.conf.LoopingByteArrayInputStream@6c63a721:an attempt to override final parameter: mapreduce.job.end-notification.max.attempts;  Ignoring.
W1115 09:26:01.526234 32586 HiveConf.java:1055] DEPRECATED: Configuration property hive.metastore.local no longer has any effect. Make sure to provide a valid value for hive.metastore.uris if you are connecting to a remote metastore.
I1115 09:26:01.546197 32586 HiveMetaStoreClient.java:238] Trying to connect to metastore with URI thrift://chapdt3hdpnm1.ops.tiaa-cref.org:9083
E1115 09:26:01.592290 32586 TSaslTransport.java:296] SASL negotiation failure
Java exception follows:
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
        at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:194)
        at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)
        at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
        at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
        at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
        at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAs(Subject.java:396)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1408)
        at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
        at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.open(HiveMetaStoreClient.java:277)
        at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.<init>(HiveMetaStoreClient.java:163)
        at org.apache.hadoop.hive.metastore.HiveMetaStoreClient.<init>(HiveMetaStoreClient.java:103)
        at com.cloudera.impala.catalog.MetaStoreClientPool.createHiveClient(MetaStoreClientPool.java:154)
        at com.cloudera.impala.catalog.MetaStoreClientPool.access$200(MetaStoreClientPool.java:31)
        at com.cloudera.impala.catalog.MetaStoreClientPool$MetaStoreClient.<init>(MetaStoreClientPool.java:51)
        at com.cloudera.impala.catalog.MetaStoreClientPool$MetaStoreClient.<init>(MetaStoreClientPool.java:44)
        at com.cloudera.impala.catalog.MetaStoreClientPool.addClients(MetaStoreClientPool.java:105)
        at com.cloudera.impala.catalog.Catalog.<init>(Catalog.java:112)
        at com.cloudera.impala.service.Frontend.<init>(Frontend.java:104)
        at com.cloudera.impala.service.JniFrontend.<init>(JniFrontend.java:109)
Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
        at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:130)
        at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:106)
        at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:172)
        at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:209)
        at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:195)
        at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:162)
        at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:175)
        ... 20 more
W1115 09:26:01.594300 32586 HiveMetaStoreClient.java:285] Failed to connect to the MetaStore Server...
I1115 09:26:01.594702 32586 HiveMetaStoreClient.java:316] Waiting 1 seconds before next connection attempt.
I1115 09:26:02.595170 32586 HiveMetaStoreClient.java:238] Trying to connect to metastore with URI thrift://chapdt3hdpnm1.ops.tiaa-cref.org:9083
E1115 09:26:02.598673 32586 TSaslTransport.java:296] SASL negotiation failure

1 ACCEPTED SOLUTION

avatar
Contributor

it was resolved   by issuing the following command

kadmin.local: modprinc -maxrenewlife 7day krbtgt/YOUR_REALM

modprinc -maxrenewlife 7day +allow_renewable impala/FQDN@YOUR_REALM

View solution in original post

2 REPLIES 2

avatar
Guru

@Ram I have moved this thread to the Impala discussion board because your issue seems specific to Impala.  Hopefully somebody in here can assist you.

 

Regards,

 

Clint

avatar
Contributor

it was resolved   by issuing the following command

kadmin.local: modprinc -maxrenewlife 7day krbtgt/YOUR_REALM

modprinc -maxrenewlife 7day +allow_renewable impala/FQDN@YOUR_REALM