使用keytab连接到安全的kerberos身份验证群集中的配置单元

Question

我正在使用CDH 5.3.3并使用hive JDBC驱动程序连接到安全集群中的配置单元.我尝试使用keytab登录

UserGroupInformation.loginUserFromKeytab(lprincipal,keytabpath);

我使用以下格式的hive网址.

JDBC:hive2://本地主机:10000; AuthMech = 1; KrbRealm = EXAMPLE.COM; KrbHostFQDN = hs2.example.com; KrbServiceName =蜂巢

示例代码:

// Authenticating Kerberos principal
System.out.println("Principal Authentication: ");
final String user = "cloudera@CLOUDERA.COM";
final String keyPath = "cloudera.keytab";
UserGroupInformation.loginUserFromKeytab(user, keyPath);
Connection connection = DriverManager.getConnection(url);

网址格式如下:

JDBC:hive2://本地主机:10000; AuthMech = 1; KrbRealm = EXAMPLE.COM; KrbHostFQDN = hs2.example.com; KrbServiceName =蜂巢

我得到以下异常,如果在确定此问题的原因时提供了一些帮助,我将不胜感激:

com.cloudera.hive.support.exceptions.GeneralException: CONN_KERBEROS_AUTHENTICATION_ERROR_GET_TICKETCACHE

javax.security.auth.login.LoginException: Unable to obtain Princpal Name for authentication
at com.sun.security.auth.module.Krb5LoginModule.promptForName(Krb5LoginModule.java:800)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:671)
at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:584)
at sun.reflect.NativeMethodAccessorImpl.inv

对于不同的集群分布,添加调试后,我看到以下异常:

DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login
DEBUG org.apache.hadoop.security.UserGroupInformation: hadoop login commit
DEBUG org.apache.hadoop.security.UserGroupInformation: using kerberos            user:null
DEBUG org.apache.hadoop.security.UserGroupInformation: using local user:UnixPrincipal: user66
DEBUG org.apache.hadoop.security.UserGroupInformation: UGI loginUser:user66 (auth:KERBEROS)
DEBUG org.apache.hadoop.security.UserGroupInformation: PrivilegedAction as:user66 (auth:KERBEROS) from:org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
DEBUG org.apache.thrift.transport.TSaslTransport: opening transport org.apache.thrift.transport.TSaslClientTransport@1f20a0ab
ERROR org.apache.thrift.transport.TSaslTransport: SASL negotiation failure
javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException:   No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
    at   com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212)
     at org.apache.thrift.transport.TSaslClientTransport.handleSaslStartMessage(TSaslClientTransport.java:94)
    at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:253)
    at org.apache.thrift.transport.TSaslClientTransport.open(TSaslClientTransport.java:37)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:52)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport$1.run(TUGIAssumingTransport.java:49)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAs(Subject.java:415)
    at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1548)
    at org.apache.hadoop.hive.thrift.client.TUGIAssumingTransport.open(TUGIAssumingTransport.java:49)
    at org.apache.hive.jdbc.HiveConnection.openTransport(HiveConnection.java:156)
    at org.apache.hive.jdbc.HiveConnection.<init>(HiveConnection.java:96)
    at org.apache.hive.jdbc.HiveDriver.connect(HiveDriver.java:104)

Answer 1

小心,凡人:Kerberos只是黑魔法.它会吸走你的灵魂.认真.

现在,激活GSSAPI跟踪的方法很难记录,这是您放大实际问题的唯一希望(可能是GSS默认丢弃的配置文件中的一个神秘的语法错误)

-Djava.security.debug=gssloginconfig,configfile,configparser,logincontext

最初的法术书就在那里.