Hello all! This is my first question here! I am trying to set a secure cluster using Kerberos. I have already install my own Kerberos server, and works like a charm on the console. The problem comes when I am trying to access to the Hadoop components UI's (HDFS, Hive, etc). I know I need to configure my browsers, and there is the problem. I have downloaded MIT Kerberos ticket system for Windows 10, installed it, and configure the krb5.ini file. It is perfectly generating the kerberos ticket (visually I can see it generated it). Following the instructions for configuring browsers to access Kerberized cluster, link, also, from external sources, like this one, (this last one made me realize I need to write down the kdc address, but I actually have included all), or this . Firefox network.negotiate-auth.delegation-uris = http://192.168.0.30, http://192.168.0.50, http://192.168.0.81, http://192.168.0.101, http://192.168.0.102, 192.168.0.30, 192.168.0.81, 192.168.0.101, 192.168.0.102, 192.168.0.50
network.negotiate-auth.trusted-uris = http://192.168.0.30, http://192.168.0.81, http://192.168.0.101, http://192.168.0.102, 192.168.0.30, 192.168.0.81, 192.168.0.101, 192.168.0.102
network.auth.use-sspi = false IE I have done the thing of putting in Internet Options -> Security -> Trusted Zones -> Add IP, Local Intranet zone -> Automatic Logon only in Local Intranet Chrome Same same... google-chrome --auth-server-whitelist = "admin/admin" or google-chrome --auth-server-whitelist = "192.168.0.81" Other observations: If I use command line to run kinit, it shows zero tickets, even though in MIT Kerberos app it has Browsers answers: java.lang.IllegalArgumentException: Malformed gss token Many others like: Authentification failure. I am out of ideas, I really trust that there is no security without Kerberos, and the next step will be to add Apache Knox, but this is for future. Can someone, please, point me anything? I have used all the google/bing links about this problems. I know this probably is related to the browsers, but I cannot discard. Note: Yes, in Ubuntu 16.04 console I am able to connect to beeline, HDFS, ..., everything is managed perfectly by Ranger (Awesome!) I am documenting all this process, so I am okay to write a guide in future for the community as giveback. -------------------------------------------------------------------------------------------------------------------------------------------------------------- Cluster info: HDP 3.1 Kerberos: 5 Accessing Machine: Windows 10, or Mac OSx Browsers: Any, IE, Chrome, Firefox. OS: Ubuntu 16.04 IP Address: kerberos server: 192.168.0.30 ambari server: 192.168.0.50 hdp-master-001: 192.168.0.81 hdp-worker-001: 192.168.0.101 hdp-worker-002: 192.168.0.102 krb5.ini [libdefaults] default_realm = CLUSTER001
[realms] EXAMPLE.COM = { admin_server = 192.168.0.30
kdc = 192.168.0.30 }
... View more
