Created on 03-05-2017 02:59 PM - edited 09-16-2022 04:11 AM
goal is to get authenticate oozie/nn/rm etc in browser
currently i'm getting below error
Problem accessing /solr/. Reason:
GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
Created 03-05-2017 03:10 PM
Have you done the following?
Open the Firefox "about:config" and then search for the following two properties and set the values to the hostname/domain that are secured:
Here you need to define the hostname/domain that you are using.
Now get the keytab on your local machine (laptop) where browser is running and then do the kinit. Then refresh the browser. Example:
kinit --kdc-hostname=kdc.hortonworks.com -t /PATH/TO/yarn.service.keytab yarn/sandbox.hortonworks.com@EXAMPLE.COM
Created 03-05-2017 04:02 PM
@Jay SenSharma i got 5 node HDP cluster along with win2k8 AD.
I'm using browser on my windows 10 machine. i do not have any krb5.conf configured on my windows 10.
Created 03-05-2017 06:11 PM
As you are getting the Keytab file from your cluster to your Windiws2k8 machine, In the same way you can get the krb5.conf file as well on your windows machine and then do a kinit.
Created 03-05-2017 06:21 PM
@Jay SenSharma i got MIT kDC on linux host where SPN's were created by ambari.
users will get their ticket from AD. I've setup one way trust between AD & MIT KDC.
i followed below link even this didnot help
Created 03-06-2017 10:38 AM
You also must set in Firefox about:config network.auth.use-sspi = false to enable Kerberos. But most likely it still won't work because Windows doesn't know that your Oozie server etc. belong to another realm. Therefore install MIT Kerberos client for Windows, details how to install here, then copy krb5.conf from your cluster to "C:\Program Files\MIT\Kerberos\krb5.ini". Then, unlike in that article, change krb5.ini and set your default realm to your AD realm, and in the domain_realm section list all cluster master node FQDN's and set their realm to your HDP realm. After that restart your PC, and try to access Oozie Web UI. In the Kerberos Ticket Manager you can see which principals have been contacted, and that your cluster masters are in the right domain.