Return-Path: X-Original-To: apmail-hadoop-mapreduce-user-archive@minotaur.apache.org Delivered-To: apmail-hadoop-mapreduce-user-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 658EBDC08 for ; Wed, 28 Nov 2012 16:05:40 +0000 (UTC) Received: (qmail 19902 invoked by uid 500); 28 Nov 2012 16:05:34 -0000 Delivered-To: apmail-hadoop-mapreduce-user-archive@hadoop.apache.org Received: (qmail 19425 invoked by uid 500); 28 Nov 2012 16:05:34 -0000 Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@hadoop.apache.org Delivered-To: mailing list user@hadoop.apache.org Received: (qmail 19400 invoked by uid 99); 28 Nov 2012 16:05:33 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 28 Nov 2012 16:05:33 +0000 X-ASF-Spam-Status: No, hits=-2.8 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_HI,SPF_HELO_PASS,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of venkat.erravelli@baml.com designates 171.161.160.26 as permitted sender) Received: from [171.161.160.26] (HELO txdmzmailmx08.bankofamerica.com) (171.161.160.26) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 28 Nov 2012 16:05:24 +0000 Received: from txdmzmailmx05.bankofamerica.com ([171.180.168.230]) by txdmzmailmx08.bankofamerica.com (8.14.5/8.14.5) with ESMTP id qASG2p7h030164 for ; Wed, 28 Nov 2012 16:05:02 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=baml.com; s=corp1210; t=1354118702; bh=aoCFovzpZ948GKa0xl90BPWsBwAZIPTdDCV67l5Ec+0=; h=Date:From:Subject:To:Message-id:MIME-version:Content-type; b=gJm28Ma9FEDM2pf5ktg0SDpaDxVOimP0rlGG7bLpRmxHbZvfk7h1hFeFYUBbT6Ufs 3wOhPQ8HAjE0GFPr8I6hOwaEJoY5dQqB1XoCCthYrOtYGCQHkdXGC3Gpi7KBcnCBeP QqeEITq3M9EZmW1N+W7njMD9irX7BaDIyyUg91os= Received: from memtx2mta03.bankofamerica.com (memtx2mta03.bankofamerica.com [171.186.232.156]) by txdmzmailmx05.bankofamerica.com (8.14.5/8.14.5) with ESMTP id qASFrHmR002874 for ; Wed, 28 Nov 2012 15:53:41 GMT Date: Wed, 28 Nov 2012 10:53:37 -0500 From: "Erravelli, Venkat" Subject: submitting a mapreduce job to remote cluster To: "user@hadoop.apache.org" Message-id: MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_mM4nH/BSKG7eU1CwmM/v2w)" Content-language: en-US Accept-Language: en-US Thread-topic: submitting a mapreduce job to remote cluster Thread-index: Ac3NgId/ZC8WzHgdT9axOtSOiJV1lA== X-MS-Has-Attach: X-MS-TNEF-Correlator: X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.9.8185,1.0.431,0.0.0000 definitions=2012-11-28_06:2012-11-28,2012-11-28,1970-01-01 signatures=0 X-Proofpoint-Spam-Reason: safe X-Virus-Checked: Checked by ClamAV on apache.org --Boundary_(ID_mM4nH/BSKG7eU1CwmM/v2w) Content-type: text/plain; CHARSET=US-ASCII Content-transfer-encoding: 7BIT Hello : I see the below exception when I submit a MapReduce Job from standalone java application to a remote Hadoop cluster. Cluster authentication mechanism is Kerberos. Below is the code. I am using user impersonation since I need to submit the job as a hadoop cluster user (userx) from my machine, on which I am logged is as user99. So: userx -- user that is setup on the hadoop cluster. user99 -- user on whoes machine the standalone java application code is executing. System.setProperty("HADOOP_USER_NAME", "userx"); final Configuration conf = new Configuration(); conf.set("hadoop.security.auth_to_local", "RULE:[1:$1@$0](.*@\\Q\\E$)s/@\\Q\\E$//" + "RULE:[2:$1@$0](.*@\\Q\\E$)s/@\\Q\\E$//" + "DEFAULT"); conf.set("mapred.job.tracker", "abcde.yyyy.com:9921"); conf.set("fs.defaultFS", "hdfs://xxxxx.yyyy.com:9920"); UserGroupInformation.setConfiguration(conf); System.out.println("here ::::: "+ UserGroupInformation.getCurrentUser()); UserGroupInformation ugi = UserGroupInformation.createProxyUser("user99", UserGroupInformation.getCurrentUser()); AuthenticationMethod am = AuthenticationMethod.KERBEROS; ugi.setAuthenticationMethod(am); final Path inPath = new Path("/user/userx/test.txt"); DateFormat df = new SimpleDateFormat("dd_MM_yyyy_hh_mm"); StringBuilder sb = new StringBuilder(); sb.append("wordcount_result_").append(df.format(new Date())); // out final Path outPath = new Path(sb.toString()); ugi.doAs(new PrivilegedExceptionAction() { <<<<---------throws exception here!!! public UserGroupInformation run() throws Exception { // Submit a job // create a new job based on the configuration Job job = new Job(conf, "word count remote"); job.setJarByClass(WordCountJob.class); job.setMapperClass(TokenizerMapper.class); job.setCombinerClass(IntSumReducer.class); job.setReducerClass(IntSumReducer.class); job.setOutputKeyClass(Text.class); job.setOutputValueClass(IntWritable.class); FileInputFormat.addInputPath(job, inPath); FileOutputFormat.setOutputPath(job, outPath); // this waits until the job completes job.waitForCompletion(true); if (job.isSuccessful()) { System.out.println("Job completed successfully"); } else { System.out.println("Job Failed"); } return UserGroupInformation.getCurrentUser(); } }); When the above code is executed, I get the below exception on the line mentioned in the code above: *************** 12/11/28 09:43:51 ERROR security.UserGroupInformation: PriviledgedActionException as: user99 (auth:KERBEROS) via userx (auth:SIMPLE) cause:org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.AccessControlException): Authorization (hadoop.security.authorization) is enabled but authentication (hadoop.security.authentication) is configured as simple. Please configure another method like kerberos or digest. Exception in thread "Main Thread" org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.AccessControlException): Authorization (hadoop.security.authorization) is enabled but authentication (hadoop.security.authentication) is configured as simple. Please configure another method like kerberos or digest. *************** Can someone tell me/point me in the right direction on what is going on here, and how do i get over this exception? Any help will be greatly appreciated. thanks! Below are the hadoop cluster configuration files: *************** Core-site.xml fs.defaultFS hdfs://xxxxx.yyyy.com:9920 io.file.buffer.size 65536 io.compression.codecs hadoop.security.authentication kerberos hadoop.security.auth_to_local RULE:[1:$1@$0](.*@\Q\E$)s/@\Q\E$// RULE:[2:$1@$0](.*@\Q\E$)s/@\Q\E$// DEFAULT Hdfs-site.xml dfs.https.address xxxxx.yyyy.com:50470 dfs.https.port 50470 dfs.namenode.http-address xxxxx.yyyy.com:50070 dfs.replication 3 dfs.blocksize 134217728 dfs.client.use.datanode.hostname false dfs.block.access.token.enable true dfs.namenode.kerberos.principal hdfs/_HOST@RND.HDFS.COM> dfs.namenode.kerberos.https.principal host/_HOST@RND.HDFS.COM> dfs.namenode.kerberos.internal.spnego.principal HTTP/_HOST@RND.HDFS.COM> Mapred-site.xml mapred.job.tracker abcde.yyyy.com:9921 mapred.output.compress false mapred.output.compression.type BLOCK mapred.output.compression.codec org.apache.hadoop.io.compress.DefaultCodec mapred.map.output.compression.codec org.apache.hadoop.io.compress.SnappyCodec mapred.compress.map.output true io.sort.factor 64 io.sort.record.percent 0.05 io.sort.spill.percent 0.8 mapred.reduce.parallel.copies 10 mapred.submit.replication 10 mapred.reduce.tasks 72 io.sort.mb 256 mapred.child.java.opts -Xmx1073741824 mapred.job.reuse.jvm.num.tasks 1 mapred.map.tasks.speculative.execution false mapred.reduce.tasks.speculative.execution false mapred.reduce.slowstart.completed.maps 1.0 mapreduce.jobtracker.kerberos.principal mapred/_HOST@RND.HDFS.COM> mapreduce.jobtracker.kerberos.https.principal host/_HOST@RND.HDFS.COM> *************** ---------------------------------------------------------------------- This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer. If you are not the intended recipient, please delete this message. --Boundary_(ID_mM4nH/BSKG7eU1CwmM/v2w) Content-type: text/html; CHARSET=US-ASCII Content-transfer-encoding: quoted-printable

Hello :

 

I see the below exception when I submit a MapReduce Job from standalone java applicat= ion to a remote Hadoop cluster. Cluster authentication mechanism is Kerbero= s.

=  

Below is the code. I am using user impersonation since I need to submit= the job as a hadoop cluster user (userx) from my machine, on which I am lo= gged is as user99. So:

 

userx -- user that is setup on the hadoop cluster.<= o:p>

use= r99 -- user on whoes machine the standalone java application code is execut= ing.

 

           &nb= sp;        System.setProperty("HADOOP_US= ER_NAME", "userx");       = ;    

        &nb= sp;   

         &n= bsp;  final Configuration conf =3D new Configuration();

 <= /o:p>

 &n= bsp;          conf.set("h= adoop.security.auth_to_local",

       =              &n= bsp;   "RULE:[1:$1@$0](.*@\\Q\\E$)s/@\\Q\\E$//"<= /o:p>

 &n= bsp;            = ;            &n= bsp;         + "RULE:[2:$1@$0](.*@\\Q= \\E$)s/@\\Q\\E$//" + "DEFAULT");

 

   &nbs= p;        conf.set("mapred.job.trac= ker", "abcde.yyyy.com:9921");

 

    &nbs= p;       conf.set("fs.defaultFS", &= quot;hdfs://xxxxx.yyyy.com:9920");

      &n= bsp;    

        =     UserGroupInformation.setConfiguration(conf);

&nbs= p;

 = ;           System.out.pr= intln("here ::::: "+ UserGroupInformation.getCurrentUser());=

 &= nbsp;         

UserGroupInformat= ion ugi =3D UserGroupInformation.createProxyUser("user99", UserGr= oupInformation.getCurrentUser());

       &n= bsp;    AuthenticationMethod am =3D AuthenticationMethod.KER= BEROS;

            ugi.= setAuthenticationMethod(am);

        &= nbsp;  

 

         &= nbsp;  final Path inPath =3D new Path("/user/userx/test.txt"= );

=  

            Date= Format df =3D new SimpleDateFormat("dd_MM_yyyy_hh_mm");

  =           StringBuilder sb =3D= new StringBuilder();

         &n= bsp;  sb.append("wordcount_result_").append(df.format(new Da= te()));

 

           = // out

            fin= al Path outPath =3D new Path(sb.toString());

 

    &nbs= p;       ugi.doAs(new PrivilegedExceptionActi= on<UserGroupInformation>() {   <<<<---------thr= ows exception here!!!

 

        &nbs= p;         public UserGroupInformat= ion run() throws Exception {

         =             &nb= sp;  // Submit a job

        = ;            &n= bsp;   // create a new job based on the configuration<= /span>

  &n= bsp;            = ;         Job job =3D new Job(conf,= "word count remote");

=  

       = ;            &n= bsp;    job.setJarByClass(WordCountJob.class);

  &nbs= p;            &= nbsp;        job.setMapperClass(Tokenize= rMapper.class);

          &n= bsp;            = ; job.setCombinerClass(IntSumReducer.class);

     &n= bsp;            = ;      job.setReducerClass(IntSumReducer.class);

&nbs= p;            &= nbsp;          job.setOutputKe= yClass(Text.class);

         &n= bsp;            &nbs= p; job.setOutputValueClass(IntWritable.class);

    &n= bsp;            = ;       FileInputFormat.addInputPath(job, inP= ath);

            =             FileOutp= utFormat.setOutputPath(job, outPath);

 

      =             &nb= sp;     // this waits until the job completes

  =              &n= bsp;        job.waitForCompletion(t= rue);

 

           &n= bsp;            if (= job.isSuccessful()) {

         &n= bsp;            = ;        System.out.println("Job co= mpleted successfully");

        &= nbsp;           &nbs= p;   } else {

         =             &nb= sp;        System.out.println("Job = Failed");

          &nb= sp;            = }

=             &nb= sp;           return User= GroupInformation.getCurrentUser();

 

      &nb= sp;           }

  =           });

 

When the above = code is executed, I get the below exception on the line mentioned in the co= de above:

***************

12/11/28 09:43:51 ERROR security.UserGroupInformation: = PriviledgedActionException as: user99 (auth:KERBEROS) via userx (auth:SIMPL= E) cause:org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.A= ccessControlException): Authorization (hadoop.security.authorization) is en= abled but authentication (hadoop.security.authentication) is configured as = simple. Please configure another method like kerberos or digest.=

Exception in = thread "Main Thread" org.apache.hadoop.ipc.RemoteException(org.ap= ache.hadoop.security.AccessControlException): Authorization (hadoop.securit= y.authorization) is enabled but authentication (hadoop.security.authenticat= ion) is configured as simple. Please configure another method like kerberos= or digest.

***************

Can someone tell me/point me in the right direction o= n what is going on here, and how do i get over this exception? Any help wil= l be greatly appreciated. thanks!

 

Below are the hadoop cluster configurati= on files:

 

***************

= Core= -site.xml

 

<?xml version=3D"1.0" encoding=3D&qu= ot;UTF-8"?>

=  

<!--Autoge= nerated by Cloudera CM on 2012-11-06T20:18:31.456Z--><= /p>

<configuration>

  <property>

    <name>f= s.defaultFS</name>

    <value>hdfs://xxxxx.yyyy.com:9920= </value>

  </property&g= t;

=   <proper= ty>

  &= nbsp; <name>io.file.buffer.size</name>

    <value>65536</va= lue>

  </= property>

  = <property>

&nb= sp;   <name>io.compression.codecs</name>

    <value>= </value>

 = ; </property>

=   <property>

    <name>hadoop.security.authentication</name&= gt;

  &nbs= p; <value>kerberos</value>

  </property>

  <property>

    <name>hadoop.securit= y.auth_to_local</name>

    <value>RULE:[1:$1@$0<= /a>](.*@\Q\E$)s/@\Q\E$//

RULE:[2= :$1@$0](.*@\Q\E$)s/@\Q\E$//<= o:p>

DEFAULT</value>= ;

<= span style=3D'font-size:9.0pt;font-family:"Courier New"'>  </proper= ty>

</configur= ation>

 = ;

 

Hdfs-s= ite.xml

 

<?xml version=3D"1.0" encoding=3D&qu= ot;UTF-8"?>

=  

<!--Autoge= nerated by Cloudera CM on 2012-11-06T20:18:31.467Z--><= /p>

<configuration>

  <property>

    <name>d= fs.https.address</name>

    <value>xxxxx.yyyy.com:50470</value>

  </property>= ;

<= span style=3D'font-size:9.0pt;font-family:"Courier New"'>  <propert= y>

  &n= bsp; <name>dfs.https.port</name>

    <value>50470</value&g= t;

=   </prope= rty>

  <p= roperty>

 &n= bsp;  <name>dfs.namenode.http-address</name>  &n= bsp;  

&n= bsp;   <value>xxxxx.yyyy.com:50070</value>

  </property>=

  <property>=

    <n= ame>dfs.replication</name>

    <value>3</value><= /span>

  </property>

  <property>

    <= ;name>dfs.blocksize</name>

    <value>134217728</value>

  </property>= ;

<= span style=3D'font-size:9.0pt;font-family:"Courier New"'>  <propert= y>

  &n= bsp; <name>dfs.client.use.datanode.hostname</name>

    <value>= false</value>

=   </property>

  <property>

    <name>dfs.block.access.token.enable</n= ame>

  =   <value>true</value>

  </property>

  <property>

    <name>dfs.namenode.k= erberos.principal</name>

    <value>hdfs/_HOST@RND.HDFS.COM</value>

  </property>

  <property>=

    <n= ame>dfs.namenode.kerberos.https.principal</name>=

    <value>host/_HOST@RND.HDFS.COM</= value>

 = </property>

&= nbsp; <property>

=     <value>HTTP/_HOST@RND.HDFS.COM</value>

  </property>

</configuration>

 

Mapred-site.xml

 

 

<?xml version=3D"1.0" encoding=3D&= quot;UTF-8"?>

<!--Auto= generated by Cloudera CM on 2012-11-06T20:18:31.456Z-->

<configuration>

  <property>=

    <name&= gt;mapred.job.tracker</name>

    <value>abcde.yyyy.com:9921</value>=

  </propert= y>

  <pro= perty>

 &nbs= p;  <name>mapred.output.compress</name><= /p>

    <value>false&= lt;/value>

 = </property>

&= nbsp; <property>

   = ; <value>BLOCK</value>

  </property>

  <property>

    <name>mapred.output.comp= ression.codec</name>

    <value>org.apache.hadoop.io.compress.Defau= ltCodec</value>

  <property>

    <name>mapred.map.output.compression.co= dec</name>

&nb= sp;   <value>org.apache.hadoop.io.compress.SnappyCodec</= value>

  <= ;/property>

 = ; <property>

&= nbsp;   <name>mapred.compress.map.output</name><= /o:p>

    <va= lue>true</value>

  </property>

  <property>

    <name>io.sort.factor</name>=

    = <value>64</value>

  </property>

  <property>

    <name>io.sort.record.percent<= ;/name>

 &nb= sp;  <value>0.05</value>

  </property>

  <property>

    <name>io.sort.spill= .percent</name>

  </property><= /p>

  <property>

    <name>map= red.reduce.parallel.copies</name>

    <value>10</value>

  </property>

  <property&g= t;

=    = ; <name>mapred.submit.replication</name>

<= p class=3DMsoNormal style=3D'text-autospace:none'>    <value>10</val= ue>

  </p= roperty>

  &= lt;property>

&nbs= p;   <name>mapred.reduce.tasks</name>

    <value>72&= lt;/value>

 = </property>

&= nbsp; <property>

    <value>256&l= t;/value>

  = </property>

&n= bsp; <property>

    <val= ue> -Xmx1073741824</value>

  </property>

  <property>

    <name>mapred.job.reuse.j= vm.num.tasks</name>

    <value>1</value>

  </property>

  <property>=

    <name&= gt;mapred.map.tasks.speculative.execution</name>

    <value>false<= ;/value>

  &= lt;/property>

&nb= sp; <property>

    <name>mapred.reduce.tasks.speculative.execution&l= t;/name>

 &n= bsp;  <value>false</value>

  </property>

  <property>

    <name>mapred.re= duce.slowstart.completed.maps</name>

    <value>1.0</value>

  </property&g= t;

=   <proper= ty>

  &= nbsp; <name>mapreduce.jobtracker.kerberos.principal</name>=

    <v= alue>mapred/_HOST@= RND.HDFS.COM</value>

  </property>

  <property>

    <name>mapreduce.jobtracker.ker= beros.https.principal</name>

    <value>host/_HOST@RND.HDFS.COM</value>

  </property>

</configuration><= o:p>

 

 

***************

 

This message, and any attachments, is for the intended recipient(s) onl= y, may contain information that is privileged, confidential and/or propriet= ary and subject to important terms and conditions available at http://www.b= ankofamerica.com/emaildisclaimer. If you are not the intended recipient, = please delete this message.
--Boundary_(ID_mM4nH/BSKG7eU1CwmM/v2w)--