3

I hava hadoop-2.7 cluster, oozie-4.0.1 running in secure mode(with kerberos). All are well. I can use cli commands submit job as follow:

but I use oozie java api submit job, kerberos exception occur.

Exception in thread "main" AUTHENTICATION : Could not authenticate, GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) at org.apache.oozie.client.AuthOozieClient.createConnection(AuthOozieClient.java:150) at org.apache.oozie.client.OozieClient.getSupportedProtocolVersions(OozieClient.java:577) at org.apache.oozie.client.OozieClient.validateWSVersion(OozieClient.java:538) at org.apache.oozie.client.OozieClient.createURL(OozieClient.java:651) at org.apache.oozie.client.OozieClient.access$100(OozieClient.java:103) at org.apache.oozie.client.OozieClient$ClientCallable.call(OozieClient.java:803) at org.apache.oozie.client.OozieClient.run(OozieClient.java:999) at com.huawei.oozie.OozieMain.main(OozieMain.java:47)

Caused by: org.apache.hadoop.security.authentication.client.AuthenticationException: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator.doSpnegoSequence(KerberosAuthenticator.java:334) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator.authenticate(KerberosAuthenticator.java:206) at org.apache.hadoop.security.authentication.client.AuthenticatedURL.openConnection(AuthenticatedURL.java:215) at org.apache.oozie.client.AuthOozieClient.createConnection(AuthOozieClient.java:144) ... 7 more

Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147) at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:122) at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187) at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:224) at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212) at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator$1.run(KerberosAuthenticator.java:313) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator$1.run(KerberosAuthenticator.java:288) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:422) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator.doSpnegoSequence(KerberosAuthenticator.java:288) ... 10 more

my java code as follow:

System.setProperty("java.security.auth.login.config", System.getProperty("user.dir") + File.separator + "conf"
            + File.separator + "jaas.conf ");
    System.setProperty("java.security.krb5.conf", System.getProperty("user.dir") + File.separator + "conf"
            + File.separator + "krb5.conf ");

    String url = "https://10.137.60.60:21003/oozie";
    AuthOozieClient wc = new AuthOozieClient(url);

    wc.setDebugMode(1);

    Properties conf = wc.createConfiguration();
    FileReader fr = new FileReader("conf/job.properties");
    conf.load(fr);

    System.out.println(conf.toString());
    String jobId = wc.run(conf);
    System.out.println("Workflow job submitted");

    while (wc.getJobInfo(jobId).getStatus() == WorkflowJob.Status.RUNNING)
    {
        System.out.println("Workflow job running ...");
        Thread.sleep(3 * 1000);
    }

    System.out.println("Workflow job completed ...");
    System.out.println(wc.getJobInfo(jobId));

my conf/jaas.conf as follow:

Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="D:/workspace/4.4-billing/Oozie/conf/oozie.keytab"
principal="[email protected]"
useTicketCache=false
storeKey=true
debug=true;
};

can anyone help me ? I know oozie use hadoop-auth jar. but how to set keytab, write authenticate code, I cannot.

3
  • 1
    1. enable Java Security debug mode with -Djava.security.debug=configfile,gssloginconfig,configparser,logincontext 2. check the encryption algorithms used by your JVM; Kerberos typically requires AES256 (not included by Oracle/Sun JRE by default, must download "unlimited strength crypto" policy JARs) 3. for a Windows path try keyTab="D:\\workspace\\4.4-billing\\Oozie\\conf\\oozie.keytab" Oct 20, 2015 at 11:52
  • @SamsonScharfrichter Your advice on the "unlimited strength crypto" policy JARs did the trick for me. Just before that I had not been able to make Oozie Client API work on Centos7 Oracle jre 1.8.
    – kasur
    Jul 26, 2016 at 12:06
  • @kasur, a must-read if you have a Kerberized Hadoop cluster: steveloughran.gitbooks.io/kerberos_and_hadoop/content/… Jul 26, 2016 at 12:42

1 Answer 1

0

set your kerberos user account as

conf.setProperty(OozieClient.USER_NAME, "xyz");
oozieClient.run(conf);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.