Return-Path: X-Original-To: apmail-hadoop-user-archive@minotaur.apache.org Delivered-To: apmail-hadoop-user-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id DF95718D2C for ; Thu, 7 Jan 2016 06:49:54 +0000 (UTC) Received: (qmail 16892 invoked by uid 500); 7 Jan 2016 06:49:49 -0000 Delivered-To: apmail-hadoop-user-archive@hadoop.apache.org Received: (qmail 16787 invoked by uid 500); 7 Jan 2016 06:49:49 -0000 Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list user@hadoop.apache.org Received: (qmail 16777 invoked by uid 99); 7 Jan 2016 06:49:49 -0000 Received: from Unknown (HELO spamd1-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 07 Jan 2016 06:49:49 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd1-us-west.apache.org (ASF Mail Server at spamd1-us-west.apache.org) with ESMTP id 16A93C0AAD for ; Thu, 7 Jan 2016 06:49:49 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd1-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 2.998 X-Spam-Level: ** X-Spam-Status: No, score=2.998 tagged_above=-999 required=6.31 tests=[HTML_MESSAGE=3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=disabled Received: from mx1-us-east.apache.org ([10.40.0.8]) by localhost (spamd1-us-west.apache.org [10.40.0.7]) (amavisd-new, port 10024) with ESMTP id Oa3JnNt1tarC for ; Thu, 7 Jan 2016 06:49:47 +0000 (UTC) Received: from mga04.intel.com (mga04.intel.com [192.55.52.120]) by mx1-us-east.apache.org (ASF Mail Server at mx1-us-east.apache.org) with ESMTP id 64B0842A21 for ; Thu, 7 Jan 2016 06:49:47 +0000 (UTC) Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga104.fm.intel.com with ESMTP; 06 Jan 2016 22:49:47 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.20,532,1444719600"; d="scan'208,217";a="629319517" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by FMSMGA003.fm.intel.com with ESMTP; 06 Jan 2016 22:49:46 -0800 Received: from FMSMSX110.amr.corp.intel.com (10.18.116.10) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.248.2; Wed, 6 Jan 2016 22:49:46 -0800 Received: from shsmsx104.ccr.corp.intel.com (10.239.4.70) by fmsmsx110.amr.corp.intel.com (10.18.116.10) with Microsoft SMTP Server (TLS) id 14.3.248.2; Wed, 6 Jan 2016 22:49:46 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.220]) by SHSMSX104.ccr.corp.intel.com ([169.254.5.183]) with mapi id 14.03.0248.002; Thu, 7 Jan 2016 14:49:44 +0800 From: "Zheng, Kai" To: "user@hadoop.apache.org" Subject: RE: Issue with WebHDFS Kerberos authentication, when running with JVM-1.7.0-SR1 or above Thread-Topic: Issue with WebHDFS Kerberos authentication, when running with JVM-1.7.0-SR1 or above Thread-Index: AQHRSHuRLjWPsrIPu0STJgcz8ARCup7vnFXg Date: Thu, 7 Jan 2016 06:49:43 +0000 Message-ID: <8D5F7E3237B3ED47B84CF187BB17B66614858181@SHSMSX103.ccr.corp.intel.com> References: <201601061211.u06CB5XH021529@d28av05.in.ibm.com> In-Reply-To: <201601061211.u06CB5XH021529@d28av05.in.ibm.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiN2Q5NDRmY2YtNDU4YS00OTg4LWJkMGUtZmEwMDIwMjBiYzI5IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX1BVQkxJQyJ9XX1dfSwiU3ViamVjdExhYmVscyI6W10sIlRNQ1ZlcnNpb24iOiIxNS40LjEwLjE5IiwiVHJ1c3RlZExhYmVsSGFzaCI6ImlyNWtQT21aWCt2bVwvcHJSQTQwakd6U1JtTDh3eUplRndyM2hwNWVHNCt3PSJ9 x-ctpclassification: CTP_PUBLIC x-originating-ip: [10.239.127.40] Content-Type: multipart/alternative; boundary="_000_8D5F7E3237B3ED47B84CF187BB17B66614858181SHSMSX103ccrcor_" MIME-Version: 1.0 --_000_8D5F7E3237B3ED47B84CF187BB17B66614858181SHSMSX103ccrcor_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable It looks like in the JDK versions in question, your client credential TGT i= sn't able to authenticate to the WebHDFS server, or the TGT doesn't match w= ith any keytab key configured for HTTP service principal. You may inspect y= our keytab file closely, checking the key version, encryption types and so = on. More logs may be helpful, for the IBM JDK, I guess you can try the foll= owing. -Dcom.ibm.security.jgss.debug=3Dall -Dcom.ibm.security.krb5.Krb5Debug=3Dall Regards, Kai From: Ravi Tatapudi [mailto:ravi_tatapudi@in.ibm.com] Sent: Wednesday, January 06, 2016 8:10 PM To: user@hadoop.apache.org Subject: Issue with WebHDFS Kerberos authentication, when running with JVM-= 1.7.0-SR1 or above Hello, Pl. find attached text-file, having the sample-code for deleting a file on = WebHDFS, with "kerberos security" enabled. I see that, this code is working successfully when run using "JDK-1.7-GA" (= i.e., with "J9VM - R27_Java727_GA_20131114_0833_B175264", as seen from the = output of the command: "java -version"). However, when the same code is run= using the JDK-1.7-SR1 or above (i.e., with "J9VM - R27_Java727_SR1_2014041= 0_1931_B195893", as seen from the output of the command: "java -version"), = it is failing with the exception shown in the attached text-file below: I also tried using the JDK-1.7-SR3.fp20 ("J9VM - R27_Java727_SR3_20151022_1= 530_B273253") & got the same exception, that I am seeing with JDK-1.7-SR1. = I have executed all these tests, using the same set of Hadoop/Hive-jars, th= e only change being the JDK-version. Could you please see the same & provide your inputs / suggestions on how to= proceed further with this issue. Thanks, Ravi --_000_8D5F7E3237B3ED47B84CF187BB17B66614858181SHSMSX103ccrcor_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

It looks like in the JDK versions in = question, your client credential TGT isn’t able to authenticate to th= e WebHDFS server, or the TGT doesn’t match with any keytab key configured for HTTP service principal. You may inspect your key= tab file closely, checking the key version, encryption types and so on. Mor= e logs may be helpful, for the IBM JDK, I guess you can try the following.<= o:p>

 

-Dcom.ibm.security.jgss.debug=3Dall -Dcom.ibm.security.krb= 5.Krb5Debug=3Dall

 

Regards,

Kai

&nbs= p;

From: Ravi Tatapudi [mailto:ravi_tatapudi@in.ibm.com]
Sent: Wednesday, January 06, 2016 8:10 PM
To: user@hadoop.apache.org
Subject: Issue with WebHDFS Kerberos authentication, when running wi= th JVM-1.7.0-SR1 or above

 

Hello,

P= l. find attached text-file, having the sample-code for deleting a file on W= ebHDFS, with "kerberos security" enabled.



I= see that, this code is working successfully when run using "JDK-1.7-G= A" (i.e., with "J9VM - R27_Java727_= GA_20131114_0833_B175264", as seen from the output of the command: "java -version"). However, when the same code is= run using the JDK-1.7-SR1 or above (i.e., with "J9VM - R27_Java727_SR1_20140410_1931_B195893", as = seen from the output of the command: "java -version"), it is failing with the exception shown in the attached text-file below:



I= also tried using the JDK-1.7-SR3.fp20 ("J9VM - R27_Java727_SR3_201= 51022_1530_B273253") & got the same exception, that I am seein= g with JDK-1.7-SR1. I have executed all these tests, using the same set of Hadoop/Hive-jars, the only change being the JDK-version.

C= ould you please see the same & provide your inputs / suggestions on how= to proceed further with this issue.

T= hanks,
&= nbsp;Ravi

--_000_8D5F7E3237B3ED47B84CF187BB17B66614858181SHSMSX103ccrcor_--