@Ali Bajwa or others can you help me on this... I did install Solr manually and kerberized the same using Windows AD server. Below is the link I used to integrate Solr with Kerberos. https://community.hortonworks.com/articles/15159/securing-solr-collections-with-ranger-kerberos.html When I try to start solr in cluster mode, I see an error which is like below: ************************************************************** [root@nn solr]# service solr status Found 1 Solr nodes:
Solr process 1490 running on port 8983
INFO - 2017-07-18 08:05:06.411; org.apache.solr.util.SolrCLI; Set HttpClientConfigurer from: org.apache.solr.client.solrj.impl.Krb5HttpClientConfigurer
INFO - 2017-07-18 08:05:06.572; org.apache.solr.client.solrj.impl.Krb5HttpClientConfigurer; Setting up SPNego auth with config: /opt/solr/bin/jaas.conf
Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is /etc/security/keytabs/solr.service_nn.keytab refreshKrb5Config is false principal is solr/nn.wwtest.net@WWTEST.NET tryFirstPass is false useFirstPass is false storePass is false clearPass is false
principal is solr/nn.wwtest.net@WWTEST.NET
Will use keytab
Commit Succeeded
ERROR: Failed to get system information from http://nn.wwtest.net:8983/solr due to: org.apache.http.client.ClientProtocolException: Expected JSON response from server but received: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<title>Error 403 GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - RC4 with HMAC)</title>
</head>
<body><h2>HTTP ERROR 403</h2>
<p>Problem accessing /solr/admin/info/system. Reason:
<pre> GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - RC4 with HMAC)</pre></p><hr><i><small>Powered by Jetty://</small></i><hr/>
</body>
</html>
Typically, this indicates a problem with the Solr server; check the Solr server logs for more information. ************************************************************** [root@nn keytabs]# klist -kte solr.service_dn1.keytab
Keytab name: FILE:solr.service_dn1.keytab
KVNO Timestamp Principal
---- ------------------- ------------------------------------------------------
1 01/01/1970 00:00:00 solr/dn1.wwtest.net@WWTEST.NET (des-cbc-crc)
1 01/01/1970 00:00:00 solr/dn1.wwtest.net@WWTEST.NET (des-cbc-md5)
1 01/01/1970 00:00:00 solr/dn1.wwtest.net@WWTEST.NET (arcfour-hmac)
1 01/01/1970 00:00:00 solr/dn1.wwtest.net@WWTEST.NET (aes256-cts-hmac-sha1-96)
1 01/01/1970 00:00:00 solr/dn1.wwtest.net@WWTEST.NET (aes128-cts-hmac-sha1-96)
[root@nn keytabs]# ************************************************************** [root@nn keytabs]# kinit -kt /etc/security/keytabs/solr.service_dn1.keytab solr/dn1.wwtest.net@WWTEST.NET
[root@nn keytabs]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: solr/dn1.wwtest.net@WWTEST.NET
Valid starting Expires Service principal
07/18/2017 08:42:49 07/18/2017 18:42:49 krbtgt/WWTEST.NET@WWTEST.NET
renew until 07/25/2017 08:42:49
[root@nn keytabs]# ************************************************************** Can some one please help.
... View more
