Return-Path: X-Original-To: apmail-hadoop-common-user-archive@www.apache.org Delivered-To: apmail-hadoop-common-user-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 354A617DC6 for ; Mon, 2 Nov 2015 11:54:30 +0000 (UTC) Received: (qmail 3441 invoked by uid 500); 2 Nov 2015 11:54:16 -0000 Delivered-To: apmail-hadoop-common-user-archive@hadoop.apache.org Received: (qmail 3308 invoked by uid 500); 2 Nov 2015 11:54:16 -0000 Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@hadoop.apache.org Delivered-To: mailing list user@hadoop.apache.org Received: (qmail 3298 invoked by uid 99); 2 Nov 2015 11:54:15 -0000 Received: from Unknown (HELO spamd3-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Nov 2015 11:54:15 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd3-us-west.apache.org (ASF Mail Server at spamd3-us-west.apache.org) with ESMTP id 6ABF9180332 for ; Mon, 2 Nov 2015 11:54:15 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd3-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 3.24 X-Spam-Level: *** X-Spam-Status: No, score=3.24 tagged_above=-999 required=6.31 tests=[FREEMAIL_ENVFROM_END_DIGIT=0.25, HTML_MESSAGE=3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, URIBL_BLOCKED=0.001] autolearn=disabled Received: from mx1-us-west.apache.org ([10.40.0.8]) by localhost (spamd3-us-west.apache.org [10.40.0.10]) (amavisd-new, port 10024) with ESMTP id Z3iHsVb9ae2J for ; Mon, 2 Nov 2015 11:54:06 +0000 (UTC) Received: from DUB004-OMC2S12.hotmail.com (dub004-omc2s12.hotmail.com [157.55.1.151]) by mx1-us-west.apache.org (ASF Mail Server at mx1-us-west.apache.org) with ESMTPS id AE3F62304E for ; Mon, 2 Nov 2015 11:54:05 +0000 (UTC) Received: from DUB129-W91 ([157.55.1.137]) by DUB004-OMC2S12.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Mon, 2 Nov 2015 03:53:57 -0800 X-TMN: [hNMSOUg8JlZUSoXnChPVCQ2Az9dvKPmW] X-Originating-Email: [danielschulz2005@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_e65e6ee0-73a6-46b7-aa0f-74cf07173deb_" From: Daniel Schulz To: "user@hadoop.apache.org" Subject: RE: Authenticating to Kerberos enabled Hadoop cluster using Java Date: Mon, 2 Nov 2015 12:53:57 +0100 Importance: Normal In-Reply-To: <9F9DE72B96464A44901B056CE36E33D8016E200F@SUSHDC8000.TD.TERADATA.COM> References: <9F9DE72B96464A44901B056CE36E33D8016E200F@SUSHDC8000.TD.TERADATA.COM> MIME-Version: 1.0 X-OriginalArrivalTime: 02 Nov 2015 11:53:57.0533 (UTC) FILETIME=[27E00CD0:01D11565] --_e65e6ee0-73a6-46b7-aa0f-74cf07173deb_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Chhaya=2C Thank you for asking straight away. At my latest project (HDP with Kerberos= ) we used authenticated users=3B as they submitted Java jobs MR or Spark re= ached through their user name and looked for a valid Kerberos Principal. Up= on file access=2C HDFS does so. So your user needs to have a valid Kerberos= Ticket from `kinit` or a keytab file. Of course: you could issue `kinit` via JNI=3B but this looks rather like a = hack. If a service needs credentials=2C I'd rather use Keystores for that. = On Hadoop with Kerberos=2C your user's Kerberos Principal is the default wa= y to go. Alternatively=2C you may use this parameter chain before start up: SET KINIT=3Dc:\Program Files\Java\jdk1.6.0_20\bin\kinit=0A= SET KEYTAB=3Dd:\webapps\app1\WEB-INF\serverhostname.keytab=0A= SET SPN=3DHTTP/app1.intranet.company.com@REALM002.COMPANY.COM=0A= SET KRB5INI=3Dd:\webapps\app1\WEB-INF\krb5.ini=0A= "%KINIT%" -k -t "%KEYTAB%" %SPN% -J-Dsun.security.krb5.debug=3Dtrue "-J-Dja= va.security.krb5.conf=3D%KRB5INI%"source: michael-behrendt.net/blog/2011/01= /kerberos-keytab-uberprufen-mit-java-boardmitteln (German) Kind regards=2C Daniel. From: Chhaya.Vishwakarma@Thinkbiganalytics.comTo: user@hadoop.apache.org Subject: Authenticating to Kerberos enabled Hadoop cluster using Java Date: Mon=2C 2 Nov 2015 10:45:37 +0000 =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= I have Kerberos enabled Hadoop cluster=2C I need to perform HDFS operations= using JAVA code.=0A= =0A= I have keytab file and username can someone please suggest how can I authet= icate to Kerberos using JAVA code?=0A= Regards=2C=0A= Chhaya=0A= = --_e65e6ee0-73a6-46b7-aa0f-74cf07173deb_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi =3BChhaya=2C

Thank you for asking straight away. At my latest project (HDP with K= erberos) we used authenticated users=3B as they submitted Java jobs MR or S= park reached through their user name and looked for a valid Kerberos Princi= pal. Upon file access=2C HDFS does so. So your user needs to have a valid K= erberos Ticket from `kinit` or a keytab file.

Of c= ourse: you could issue `kinit` via JNI=3B but this looks rather like a hack= . If a service needs credentials=2C I'd rather use Keystores for that. On H= adoop with Kerberos=2C your user's Kerberos Principal is the default way to= go.

Alternatively=2C you may use this parameter c= hain before start up:

SET KINIT=3Dc:\Program File=
s\Java\jdk1.6.0_20\bin\kinit=0A=
SET KEYTAB=3Dd:\webapps\app1\WEB-INF\serverhostname.keytab=0A=
SET SPN=3DHTTP/app1.intranet.company.com@REALM002.COMPANY.COM=0A=
SET KRB5INI=3Dd:\webapps\app1\WEB-INF\krb5.ini=0A=
"%KINIT%" -k -t "%KEYTAB%" %SPN% -J-Dsun.security.krb5.debug=3Dtrue "-J-Dja=
va.security.krb5.conf=3D%KRB5INI%"

Kind regards=2C Daniel.

<= hr id=3D"stopSpelling">
From: Chhaya.Vishwakarma@Thinkbiganalytic= s.com
To: user@hadoop.apache.org
Subject: Authenticating to Ke= rberos enabled Hadoop cluster using Java
Date: Mon=2C 2 Nov 2015 10:45:3= 7 +0000

=0A= =0A= =0A= =0A= =0A= =0A= =0A=
=0A=

=0A= I have Kerberos enabled Hadoo= p cluster=2C I need to perform HDFS operations using JAVA code.

= =0A=

=0A= I have keytab file and userna= me can someone please suggest how can I autheticate to Kerberos using JAVA = code?

=0A=

Regards=2C

=0A=

Chhaya

=0A=
= --_e65e6ee0-73a6-46b7-aa0f-74cf07173deb_--