0

I have used kerberos rest template to access the job history server on kerberized hadoop but this code is throwing me an exception:

KerberosRestTemplate kerberosRestTemplate = new KerberosRestTemplate(properties.getProperty("userKeytabPath"),properties.getProperty("userprincipal"));                   System.out.println(kerberosRestTemplate.getForObject(jobhistoryurl, String.class));

Exception:

Exception in thread "main" org.springframework.web.client.RestClientException: Error running rest call; nested exception is org.springframework.web.client.HttpClientErrorException: 401 Authentication required
    at org.springframework.security.kerberos.client.KerberosRestTemplate.doExecute(KerberosRestTemplate.java:196)
    at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:530)
    at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:237)
    at com.datametica.hiveconnection.hiveconnectioncheck.HivePortCheck.main(HivePortCheck.java:57)
Caused by: org.springframework.web.client.HttpClientErrorException: 401 Authentication required
    at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:91)
    at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:614)
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:570)
    at org.springframework.security.kerberos.client.KerberosRestTemplate.doExecuteSubject(KerberosRestTemplate.java:202)
    at org.springframework.security.kerberos.client.KerberosRestTemplate.access$100(KerberosRestTemplate.java:67)
    at org.springframework.security.kerberos.client.KerberosRestTemplate$1.run(KerberosRestTemplate.java:191)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAs(Subject.java:360)
    at org.springframework.security.kerberos.client.KerberosRestTemplate.doExecute(KerberosRestTemplate.java:187)
    ... 3 more

So is there any extra parameters that i have to pass in request headers to access kerberos secured apis? Also before Accessing this api i have logged in a user via same user principal and keytab provided in kerberosRestTemplate Using UserGroupInformation class of hadoop security.

 UserGroupInformation.loginUserFromKeytab(properties.getProperty("userprincipal"),properties.getProperty("userKeytabPath"));

I have check the current user logged in(via ugi of current user) before accessing job history and it is giving me that user is logged in and with kerberos authentication but i am still getting 401 status from job history server.

Jasvinder Singh
  • 1
  • 1
  • To get some debug traces, add `-Dsun.security.spnego.debug=true -Dsun.security.krb5.debug=true -Djava.security.debug=gssloginconfig,configfile,configparser,logincontext` – Samson Scharfrichter Jan 19 '17 at 15:42
  • Thank you for the suggestion. I have tried running in debug mode it showing the following error. – Jasvinder Singh Jan 23 '17 at 09:45
  • @Samson Scharfrichter Thank you for the suggestion. I have tried running in debug mode it showing the following error. KrbException: Server not found in Kerberos database (7) - LOOKING_UP_SERVER – Jasvinder Singh Jan 23 '17 at 09:51
  • https://steveloughran.gitbooks.io/kerberos_and_hadoop/content/sections/errors.html – Samson Scharfrichter Jan 23 '17 at 10:16
  • Kerberos requires canonical DNS names, i.e. it does a DNS scan **then** a DNS reverse scan. If the IP does not point back to the original name, then Kerberos considers it's a hack attempt (IP spoofing). – Samson Scharfrichter Jan 23 '17 at 10:17
  • Set up your client `/etc/hosts` config to overeride teh DNS entries if necessary. – Samson Scharfrichter Jan 23 '17 at 10:19
  • that server already has a hosts file but it contains internal ip's of all master and slave nodes not the public ip's.Is this configuration is creating the problem? Should i provide public ip's there? – Jasvinder Singh Jan 25 '17 at 09:10
  • Again, but louder: CHECK WHETHER THE DNS ENTRIES ARE COHERENT i.e. `nslookup somehost.somedomain` points to an IP and `nslookup 1.2.3.4` points back to the same exact host name. **If** they are not, then the "hosts" file is a **possible workaround**. – Samson Scharfrichter Jan 25 '17 at 09:45

0 Answers0