hive-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Chaoyu Tang (JIRA)" <>
Subject [jira] [Commented] (HIVE-15485) Investigate the DoAs failure in HoS
Date Thu, 22 Dec 2016 21:56:58 GMT


Chaoyu Tang commented on HIVE-15485:

HIVE-14383 is the right way to renew the delegation token for a long running HoS session.
Spark needs the principal/keytab passed in via --principal and --keytab options, and does
the renewal by copying the keytab to the cluster and handling login to kerberos inside the
But the option --principal, --keytab could not work with --proxy-user in as
suggested by [~vanzin], so at this moment we could support either the token renewal or the
impersonation, but not both.

> Investigate the DoAs failure in HoS
> -----------------------------------
>                 Key: HIVE-15485
>                 URL:
>             Project: Hive
>          Issue Type: Bug
>            Reporter: Chaoyu Tang
>            Assignee: Chaoyu Tang
> With DoAs enabled, HoS failed with following errors:
> {code}
> Exception in thread "main" systest
tries to renew a token with renewer hive
> 	at
> 	at org.apache.hadoop.hdfs.server.namenode.FSNamesystem.renewDelegationToken(
> 	at org.apache.hadoop.hdfs.server.namenode.NameNodeRpcServer.renewDelegationToken(
> 	at org.apache.hadoop.hdfs.server.namenode.AuthorizationProviderProxyClientProtocol.renewDelegationToken(
> 	at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolServerSideTranslatorPB.renewDelegationToken(
> 	at org.apache.hadoop.hdfs.protocol.proto.ClientNamenodeProtocolProtos$ClientNamenodeProtocol$2.callBlockingMethod(
> 	at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$
> 	at org.apache.hadoop.ipc.RPC$
> 	at org.apache.hadoop.ipc.Server$Handler$
> 	at org.apache.hadoop.ipc.Server$Handler$
> 	at Method)
> 	at
> 	at
> 	at org.apache.hadoop.ipc.Server$
> {code}
> It is related to the change from HIVE-14383. It looks like that SparkSubmit logs in Kerberos
with passed in hive principal/keytab and then tries to create a hdfs delegation token for
user systest with renewer hive.

This message was sent by Atlassian JIRA

View raw message