Mailing-List: contact user-help@accumulo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@accumulo.apache.org
Message-ID: <56A7B68D.7010906@gmail.com>
Date: Tue, 26 Jan 2016 13:10:21 -0500
From: Josh Elser <josh.elser@gmail.com>
User-Agent: Postbox 3.0.11 (Macintosh/20140602)
MIME-Version: 1.0
To: user@accumulo.apache.org
Subject: Re: Accumulo and Kerberos
References: 
 <BCC02AAED69CF04AA5850BE434F60636A1599B7F@UKDC1CSUEXMV02.CSU.LOCAL>
In-Reply-To: 
 <BCC02AAED69CF04AA5850BE434F60636A1599B7F@UKDC1CSUEXMV02.CSU.LOCAL>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit

Hi Roman,

Accumulo services (TabletServer, Master, etc) all use a keytab to 
automatically obtain a ticket from the KDC when they start up. You do 
not need to do anything with kinit when starting Accumulo.

One worry is ACCUMULO-4069[1] with all presently released versions (most 
notably 1.7.0 which you are using). This is a bug in which services did 
not automatically renew their ticket. We're working on a 1.7.1, but it's 
not out yet.

As for debugging your issue, take a look at the Kerberos section on 
debugging in the user manual [2]. Take a very close look at the 
principal the service is using to obtain the ticket and what the 
principal is for your keytab. A good sanity check is to make sure you 
can `kinit` in the shell using the keytab and the correct principal 
(rule out the keytab being incorrect).

If you still get stuck, collect the output specifying 
-Dsun.security.krb5.debug=true in accumulo-env.sh (per the instructions) 
and try enabling log4j DEBUG on 
org.apache.hadoop.security.UserGroupInformation.

- Josh

[1] https://issues.apache.org/jira/browse/ACCUMULO-4069
[2] http://accumulo.apache.org/1.7/accumulo_user_manual.html#_debugging

roman.drapeko@baesystems.com wrote:
> Hi there,
>
> Trying to setup Accumulo 1.7 on Kerberized cluster. Only interested in
> master/tablets to be kerberized (not end-users). Configured everything
> as per manual:
>
> 1)Created principals
>
> 2)Generated glob keytab
>
> 3)Modified accumulo-site.xml providing general.kerberos.keytab and
> general.kerberos.principal
>
> If I start as accumulo user I get: Caused by: GSSException: No valid
> credentials provided (Mechanism level: Failed to find any Kerberos tgt)
>
> However, if I give explicitly a token with kinit and keytab generated
> above in the shell � it works as expected. To my understanding Accumulo
> has to obtain tickets automatically? Or the idea is to write a cron job
> and apply kinit to every tablet server per day?
>
> Regards,
>
> Roman
>
> Please consider the environment before printing this email. This message
> should be regarded as confidential. If you have received this email in
> error please notify the sender and destroy it immediately. Statements of
> intent shall only become binding when confirmed in hard copy by an
> authorised signatory. The contents of this email may relate to dealings
> with other companies under the control of BAE Systems Applied
> Intelligence Limited, details of which can be found at
> http://www.baesystems.com/Businesses/index.htm.