I'm stuck on an logging in to Ambari UI via Knox, I've configured Knox to use HeaderPreAuth(SiteMinder). Is it even possible to access the HDP UI's in that way? What happens is that I get no further than Amabri's login view. I've verified that i can use WebHDFS through Knox with the same configuration. This is the process for what I've tried so far: I set the SiteMinder header in the browser using a plugin. I've configured a topology like this <topology>
I also tried adding the AMBARI service role in the topology but it didn't make any difference. Then I've configured the 'service.xml' file for the AmbariUI service to use the federation policy: <service role="AMBARIUI" name="ambariui" version="2.2.0">
</service> I can see that the user specified in the SiteMinder header is picked up by Knox in the gateway-audit log file. I can't find any errors in any logs, the only remotely interesting information is that i seem to get a Response status: 400 in the gateway-audit logs when i perform the request. Any ideas why this isn't working? Have I missed some important step?
... View more
I'm having issues with Kerberos tickets for Hadoop services not being renewed before they expire.
E.g the ticket for Oozie, it is valid for 10h and then it takes a certain number of hours until the ticket is renewed(or recreated) again.
I'm expecting there to always be a valid ticket present for the services. The effect of this is e.g that I can't list directories in HDFS as the Oozie user(in the shell), it fails with the following error message: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)] I can renew the ticket again manually using the keytab which makes the HDFS listing work but i feel that it shouldn't be necessary. Strangely enough there are never any service related errors in Ambari. Any ideas on how to resolve this?
... View more