About matt_andruff

quanlong · ‎12-17-2023

Saw the same issue and debug it by adding Java option -Dsun.security.krb5.debug=true In the logs, I found the IP address of KDC is shown instead of the hostname. That's suspicious. So I tried adding the IP -> hostname mapping of the KDC server in /etc/hosts. It resolved the issue. There could be other causes for your issue. The debug logs can show you more clues.

cravani · ‎09-17-2018

@Matt Andruff Accessing Ambari, Atlas, Zeppelin would give a Annonymous access to it's UIs, and Authenticatin is managed by that component individually by default, meaning User can access the UIs using Knox and will have to provide logins configured for it. With Zeppelin 0.8 onwards which comes with HDP 3.0, there is a support for KnoxSSO which can be used to login to ZeppelinUI. Ref: https://zeppelin.apache.org/docs/0.8.0/setup/security/shiro_authentication.html#knox-sso https://issues.apache.org/jira/browse/ZEPPELIN-3090 https://knox.apache.org/books/knox-0-13-0/dev-guide.html#KnoxSSO+Integration Up till HDP 2.6.5 does not support Zeppelin KnoxSSO Integration.

matt_andruff · ‎04-08-2018

Interestingly I did try "use" but zeppelin's SQL interpreter doesn't seem to track 'use database' between statements. Maybe that's an issue I should report. @bkosaraju I really appreciate the thorough answer.

matt_andruff · ‎04-08-2018

Turns out I had added the the LLAP pibs twice.

matt_andruff · ‎03-14-2018

@Kshitij Badani How do we get full write access to llap in HDP 2.6.3? I'm happy to do work to make this work, otherwise I'll have to tell my client to down grade back to 2.6.2. I'd prefer not to do that.

xyao · ‎02-01-2018

Can you check you hadoop.kms.authentication.kerberos.name.rules settings from kms-site.xml? Try "DEFAULT" if you have a customized setting that is invalid. You mentioned that the kms principle is changed. Can you also post your hadoop.kms.authentication.kerberos.principal and hadoop.security.auth_to_local settings from core-site.xml?

matt_andruff · ‎01-31-2018

rebooted all services that had keytabs, and then I was able to connect. There error stopped. Thanks for the responses.

matt_andruff · ‎12-11-2017

@Manfred PAUL Im my last reply I actually meant to include a link to this article: https://community.hortonworks.com/articles/110104/fixing-hiveserver-interactive-llap-failures-with-e.html

matt_andruff · ‎09-27-2017

nm I eventually got it: cluster create --version 2.6 --description "Haoop Pilot" --password D@T@L@K3_2017 --enableKnoxGateway true --stackRepoId HDP-2.6 --stackBaseURL "http://public-repo-1.hortonworks.com/HDP/centos7/2.x/updates/2.6.0.3" --stack "HDP" --utilsBaseURL "http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/centos7" --utilsRepoId "HDP-UTILS-1.1.0.21" --os RedHat --ambariRepoBaseURL http://public-repo-1.hortonworks.com/ambari/centos6/2.x/updates/2.5.0.3 --ambariVersion 2.5.0.3-7 --ambariRepoGpgKey http://public-repo-1.hortonworks.com/ambari/centos6/RPM-GPG-KEY/RPM-GPG-KEY-Jenkins --verify true Cluster creation started So I guess just a better error mesasge would be helpful saying that "--version" required.

akanto · ‎09-20-2017

Hi @Matt Andruff, Cloudbreak does not populate kerberos related settings into the gateway-site.xml config file of Knox: https://github.com/apache/knox/blob/master/gateway-release/home/conf/gateway-site.xml#L40 E.g gateway.hadoop.kerberos.secured is not set and krb5.conf is not set. Until this is fixed in Cloudbreak I recommend not to select the "Enable Knox Gateway" on Cloudbreak, but as a workaround you can add KNOX_SERVER into the blueprint and let Ambari configure Knox. Kind regards, Attila

Online	Offline
Last Visited	‎08-12-2019 05:02 PM

Member Since	‎08-10-2016 12:09 PM
Last Visited	‎08-12-2019 05:02 PM
Posts	170
Kudos received	14

Cloudera Community

Re: Kerberos: Failure to initialize security conte...

Re: Can I add a subcolumn to a hive struct column ...

Re: Cloudbreak verbose logging - RuntimeException:...

Re: Solr query question

Re: How to get EPOCH time in PIG?

Re: Identifier doesn't match expected value (906)

Re: Knox allowing anonymous users

Re: Hive LLAP ranger insert issue (requires defaul...

Re: zeppelin + Livy failes

Re: LLAP, Livy & Zeppelin not using LLAP

Re: kerberos: Authentication failed, status: 404, ...

Re: Kerberos: Failure to initialize security conte...

Re: hive / llap / slider / kerberos : error while ...

Re: Cloudbreak verbose logging - RuntimeException:...

Re: Cloudbreak 1.16 - Adding security breaks Ambar...