Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

javax.security.sasl.SaslException: Failure to initialize security context [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos credentails) #18497

Open
wangbin83-gmail-com opened this issue Jan 25, 2024 · 3 comments
Labels
type-bug This issue is about a bug

Comments

@wangbin83-gmail-com
Copy link

Alluxio Version:
release-2.8.1

Describe the bug
Using HDFS as the alloxio UFS, HDFS enables secure mode, and the corresponding configuration and ticket credentials for KerberOS are correct. However, when starting alloxio, the job_ Worker startup failed, and the log shows that the ticket voucher cannot be found and the leader master cannot be connected. The error message is as follows:

1706154906861

Expected behavior
I hope that the cluster can be used normally after using kerberos authentication

Urgency
This issue has a significant impact, leading to project stagnation

@wangbin83-gmail-com wangbin83-gmail-com added the type-bug This issue is about a bug label Jan 25, 2024
@jasondrogba
Copy link
Contributor

you can look at Connect to Secure HDFS.
You can put the contents of conf/alluxio-site.properties here, to make sure and check that there are no problems with your configuration.

@wangbin83-gmail-com
Copy link
Author

alluxio-site.properties
1706164555011

@jasondrogba
Copy link
Contributor

jasondrogba commented Jan 25, 2024

reference: connect to Secure HDFS

A known limitation is that the Kerberos TGT may expire after the max renewal lifetime. You can work around this by renewing the TGT periodically. Otherwise you may see No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) when starting Alluxio services. Another option is to set alluxio.hadoop.security.kerberos.keytab.login.autorenewal=true so the TGT is automatically refreshed.

Maybe you can try this. but release-2.8.1 do not have alluxio.hadoop.kerberos.keytab.login.autorenewal.
you can use release-2.9.3.
alluxio.hadoop.kerberos.keytab.login.autorenewal is correct, hdfs doc has updated #18487

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-bug This issue is about a bug
Projects
None yet
Development

No branches or pull requests

2 participants