Hue 集成Kerberos 导致Kerberos Ticket Renewer 起不来

最新推荐文章于 2023-05-16 10:18:13 发布

原创最新推荐文章于 2023-05-16 10:18:13 发布 · 2.3k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#Kerberos #hue #异常 #Kerberos Ticket Renewer

Kerberos 专栏收录该内容

4 篇文章

订阅专栏

本文详细记录了一次KerberosTicketRenewer无法启动的问题排查过程，包括错误日志分析、kinit命令使用及KDC配置检查。通过调整krbtgt和hue服务主体的票证续期策略，最终解决了票证无法更新的问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

报错，Kerberos Ticket Renewer 起不来，查看日志

[19/Jan/2018 07:10:08 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:08 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/cdh21@HADOOP.COM' is still renewable:
  $ klist -f -c /run/hue/hue_krb5_ccache
If the 'renew until' date is the same as the 'valid starting' date, the ticket cannot be renewed. Please check your KDC configuration, and the ticket renewal policy (maxrenewlife) for the 'hue/cdh21@HADOOP.COM' and `krbtgt' principals.
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_NAME SET: /usr/local/hue/desktop/desktop-test.db
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_USER SET: hue_test
[19/Jan/2018 07:10:09 +0000] __init__     INFO     Couldn't import snappy. Support for snappy compression disabled.
[19/Jan/2018 07:10:09 +0000] kt_renewer   INFO     Reinitting kerberos from keytab: /usr/bin/kinit -k -t /etc/security/keytabs/hue.service.keytab -c /var/run/hue/hue_krb5_ccache hue/cdh21@HADOOP.COM
[19/Jan/2018 07:10:10 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:10 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/cdh21@HADOOP.COM' is still renewable:

解决办法：

linux 执行：
[root@cdh21 hbase]# klist -f -c /run/hue/hue_krb5_ccache
Ticket cache: FILE:/run/hue/hue_krb5_ccache
Default principal: hue/cdh21@HADOOP.COM

Valid starting Expires Service principal
2018-12-13T15:46:56 2018-12-14T15:46:56 krbtgt/HADOOP.COM@HADOOP.COM
renew until 2018-12-20T15:46:54, Flags: FRIT

这个问题的原因是：ticket无法更新
如果过了Expires,可以通过命令kinit –R来更新ticket
但如果ticket无法更新
[root@vmw201 ~]$ kinit -R kinit: Ticket expired while renewing credentials
这是因为krbtgt/HADOOP.COM@ HADOOP.COM的[renewlife]被设置成了0，这一点可以通过[kadmin.local => getprinc krbtgt/ HADOOP.COM @ HADOOP.COM]看出来。

进入命令行，将上面的查询出来的两个结果进行赋值即可：重启，正常运行

[root@cdh21 bin]# kadmin.local
Authenticating as principal hue/cdh21@HADOOP.COM with password.
kadmin.local: modprinc -maxrenewlife 90day krbtgt/HADOOP.COM@HADOOP.COM
Principal “krbtgt/HADOOP.COM@HADOOP.COM” modified.
kadmin.local: modprinc -maxrenewlife 90day +allow_renewable hue/cdh21@HADOOP.COM
Principal “hue/cdh21@HADOOP.COM” modified.