Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

ZooKeeper kerberos Server Authentication issue

avatar
New Contributor

getting this exception while brining up the Zkservers

 

ERROR 2019-10-15 10:31:44,851 [main] QuorumPeerMain - Unexpected exception, exiting abnormally
javax.security.sasl.SaslException: Failed to initialize authentication mechanism using SASL [Caused by javax.security.auth.login.LoginException: SASL-authentication failed because the specified JAAS configuration section 'QuorumServer' could not be found.]
at org.apache.zookeeper.server.quorum.auth.SaslQuorumAuthServer.<init>(SaslQuorumAuthServer.java:68)
at org.apache.zookeeper.server.quorum.QuorumPeer.initialize(QuorumPeer.java:886)
at org.apache.zookeeper.server.quorum.QuorumPeerMain.runFromConfig(QuorumPeerMain.java:203)
at org.apache.zookeeper.server.quorum.QuorumPeerMain.initializeAndRun(QuorumPeerMain.java:123)
at org.apache.zookeeper.server.quorum.QuorumPeerMain.main(QuorumPeerMain.java:82)
Caused by: javax.security.auth.login.LoginException: SASL-authentication failed because the specified JAAS configuration section 'QuorumServer' could not be found.
at org.apache.zookeeper.server.quorum.auth.SaslQuorumAuthServer.<init>(SaslQuorumAuthServer.java:59)

2 REPLIES 2

avatar
Master Mentor

@Vij 

 

Can you share your share your zookeeper_client_jaas.conf and zookeeper_jaas.conf they should be look like below

zookeeper_client_jaas.conf

Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=false
useTicketCache=true;
};

zookeeper_jaas.conf

Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
useTicketCache=false
keyTab="/etc/security/keytabs/zk.service.keytab"
principal="zookeeper/<host>@[REALM]";
};

 

Please compare and let me know 

 

avatar
New Contributor

@Shelton  Thank you for your response but as of now first i am testing between server to server authentication and this is how my JAAS files looks like which i refereed from this wiki 

 

https://cwiki.apache.org/confluence/display/ZOOKEEPER/Server-Server+mutual+authentication

 

 

QuorumServer {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="<keytab path>"
storeKey=true
useTicketCache=false
debug=false
principal="<principal>/_HOST@[REALM]";
};

QuorumLearner {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="<keytab path>"
storeKey=true
useTicketCache=false
debug=false
principal="<principal>/_HOST@[REALM]";
};