During my sentry installation, I have faced an issue that gave me big flag on CDH manager. on step 5, Sentry principal keytab is failing to authenticate. My guess is, someone changed (or deleted and recrated) the sentry principal and CDH manager is sending a different keytab everytime I try to set the server. I have searched the sentry keytab file on server and I see that CDH mngr creates different keytab file with different attemp number extention everytime send a request(everytime I try to set up) 1. where is the keytab file that CDH mngr keeps and sends for sentry authentication? 2. Do I have to uninstall and reinstall kerberos to get the sentry principal correctly setup? I have tried every possible way and this is the only one left. 3. Why is CDH mngr is set up like this? This is a decision point in our company to choose best Hadoop Distro enterprice version and we already have a glitch when we were enable Kerberos in CDH Here is the Error log: JAVA_HOME=/usr/java/jdk1.7.0_67-cloudera using /usr/java/jdk1.7.0_67-cloudera as JAVA_HOME using 5 as CDH_VERSION Debug is true storeKey true useTicketCache true useKeyTab true doNotPrompt true ticketCache is null isInitiator true KeyTab is /var/run/cloudera-scm-agent/process/1625-sentry-SENTRY_SERVER/sentry.keytab refreshKrb5Config is true principal is sentry/********.********.dev@********.DEV tryFirstPass is false useFirstPass is false storePass is false clearPass is false Refreshing Kerberos configuration Acquire TGT from Cache Principal is sentry/********.********.dev@********.DEV null credentials from Ticket Cache [Krb5LoginModule] authentication failed Integrity check on decrypted field failed (31) - PREAUTH_FAILED Mon Sep 25 08:47:18 EDT 2017 JAVA_HOME=/usr/java/jdk1.7.0_67-cloudera using /usr/java/jdk1.7.0_67-cloudera as JAVA_HOME using 5 as CDH_VERSION Debug is true storeKey true useTicketCache true useKeyTab true doNotPrompt true ticketCache is null isInitiator true KeyTab is /var/run/cloudera-scm-agent/process/1625-sentry-SENTRY_SERVER/sentry.keytab refreshKrb5Config is true principal is sentry/********.********.dev@********.DEV tryFirstPass is false useFirstPass is false storePass is false clearPass is false Refreshing Kerberos configuration Acquire TGT from Cache Principal is sentry/********.********.dev@********.DEV null credentials from Ticket Cache [Krb5LoginModule] authentication failed Integrity check on decrypted field failed (31) - PREAUTH_FAILED
... View more
