- Subscribe to RSS Feed
- Mark Question as New
- Mark Question as Read
- Float this Question for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
keyadmin user not working after enabling Kerberos
- Labels:
-
Apache Ranger
Created 04-14-2016 11:27 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Since I've enabled Kerberos I cannot get the keyadmin user to list the previously created keys or create new ones. First I noticed that the keyadmin principal hadn't been created along the other ones during the Kerberos set up. I did add it manually following these instructions:
Also part 6.b is not very clear to me at
What values are those attributes supposed to have?
The error I see in the kms-audit.log file is:
2016-04-14 18:54:57,923 UNAUTHENTICATED RemoteHost:xxxxxxxx Method:GET URL:http://xxxxxxxxxx:9292/kms/v1/keys/names?doAs=keyadmin ErrorMsg:'Authentication required' Thanks, Sadek
Created 04-17-2016 06:56 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was able to resolve it after restarting Ranger Service.
Ambari does not prompt for restarting Ranger service, but prompt for only Ranger Kms.
Be sure to edit the repository username from Ranger UI by logging in as keyadmin user.
Changing user from Ambari does not work.
Set values of below to *
hadoop.kms.proxyuser.hive.users=*
hadoop.kms.proxyuser.oozie.users=*
hadoop.kms.proxyuser.HTTP.users=*
hadoop.kms.proxyuser.ambari.users=*
hadoop.kms.proxyuser.yarn.users=*
hadoop.kms.proxyuser.hive.hosts=*
hadoop.kms.proxyuser.oozie.hosts=*
hadoop.kms.proxyuser.HTTP.hosts=*
hadoop.kms.proxyuser.ambari.hosts=*
hadoop.kms.proxyuser.yarn.hosts=*
Created 04-15-2016 11:17 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same problem here on HDP 2.3.4 with Ambari 2.2.0
Changing hadoop.kms.authentication.type to simple works fine.
Created 04-15-2016 12:32 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But turning off Kerberos auth is not an option for me.
Created 04-17-2016 05:30 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please first configure KMS for Kerberos authentication.
Use second link you have mentioned in your question.
Regarding point 6b
Add values for the following properties in the "Custom kms-site" section. These properties allow the specified system users (hive
, oozie
, and others) to proxy on behalf of other users when communicating with Ranger KMS. This helps individual services (such as Hive) use their own keytabs, but retain the ability to access Ranger KMS as the end user (use access policies associated with the end user).
hadoop.kms.proxyuser.hive.users
hadoop.kms.proxyuser.oozie.users
hadoop.kms.proxyuser.HTTP.users
hadoop.kms.proxyuser.ambari.users
hadoop.kms.proxyuser.yarn.users
hadoop.kms.proxyuser.hive.hosts
hadoop.kms.proxyuser.oozie.hosts
hadoop.kms.proxyuser.HTTP.hosts
hadoop.kms.proxyuser.ambari.hosts
hadoop.kms.proxyuser.yarn.hosts
These properties are for user impersonation
Created 04-17-2016 06:56 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was able to resolve it after restarting Ranger Service.
Ambari does not prompt for restarting Ranger service, but prompt for only Ranger Kms.
Be sure to edit the repository username from Ranger UI by logging in as keyadmin user.
Changing user from Ambari does not work.
Set values of below to *
hadoop.kms.proxyuser.hive.users=*
hadoop.kms.proxyuser.oozie.users=*
hadoop.kms.proxyuser.HTTP.users=*
hadoop.kms.proxyuser.ambari.users=*
hadoop.kms.proxyuser.yarn.users=*
hadoop.kms.proxyuser.hive.hosts=*
hadoop.kms.proxyuser.oozie.hosts=*
hadoop.kms.proxyuser.HTTP.hosts=*
hadoop.kms.proxyuser.ambari.hosts=*
hadoop.kms.proxyuser.yarn.hosts=*
Created 04-18-2016 11:10 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That did it!.
Created 04-18-2016 05:24 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That didn't quite fix everything though. I was trying to put a file in an (hdfs) encryted zone and got the follwoing exception:
put: java.util.concurrent.ExecutionException: org.apache.hadoop.security.authorize.AuthorizationException: User:nn not allowed to do 'GENERATE_EEK' on 'mykey'.
The nn procipal should map to the 'hdfs' OS user according to the entry in
hadoop.security.auth_to_local: RULE:[2:$1@$0](nn@MYREALM.COM)s/.*/hdfs/
Even after adding similar properties as above to the hdfs user
hadoop.kms.proxyuser.hdfs.users=*
hadoop.kms.proxyuser.hdfs.hosts=*
And allowing all permissions to 'hdfs' user in the KMS policy.
Created 04-19-2016 03:19 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I understand this correctly, you are trying to use TDE with hdfs user.
This will not work because hdfs user is blacklisted for TDE operations.
Here is note from Hortonworks Doc.
For separation of administrative roles, do not use the hdfs
user to create encryption zones. Instead, designate another administrative account for creating encryption keys and zones. See Creating an HDFS Admin User for more information.