Hue 集成Kerberos 导致Kerberos Ticket Renewer 起不来

报错，Kerberos Ticket Renewer 起不来，查看日志

[19/Jan/2018 07:10:08 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:08 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/cdh21@HADOOP.COM' is still renewable:
  $ klist -f -c /run/hue/hue_krb5_ccache
If the 'renew until' date is the same as the 'valid starting' date, the ticket cannot be renewed. Please check your KDC configuration, and the ticket renewal policy (maxrenewlife) for the 'hue/cdh21@HADOOP.COM' and `krbtgt' principals.
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_NAME SET: /usr/local/hue/desktop/desktop-test.db
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_USER SET: hue_test
[19/Jan/2018 07:10:09 +0000] __init__     INFO     Couldn't import snappy. Support for snappy compression disabled.
[19/Jan/2018 07:10:09 +0000] kt_renewer   INFO     Reinitting kerberos from keytab: /usr/bin/kinit -k -t /etc/security/keytabs/hue.service.keytab -c /var/run/hue/hue_krb5_ccache hue/cdh21@HADOOP.COM
[19/Jan/2018 07:10:10 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:10 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/cdh21@HADOOP.COM' is still renewable:

解决办法：

linux 执行：
[root@cdh21 hbase]# klist -f -c /run/hue/hue_krb5_ccache
Ticket cache: FILE:/run/hue/hue_krb5_ccache
Default principal: hue/cdh21@HADOOP.COM

Valid starting Expires Service principal
2018-12-13T15:46:56 2018-12-14T15:46:56 krbtgt/HADOOP.COM@HADOOP.COM
renew until 2018-12-20T15:46:54, Flags: FRIT

这个问题的原因是：ticket无法更新
如果过了Expires,可以通过命令kinit –R来更新ticket
但如果ticket无法更新
[root@vmw201 ~]$ kinit -R kinit: Ticket expired while renewing credentials
这是因为krbtgt/HADOOP.COM@ HADOOP.COM的[renewlife]被设置成了0，这一点可以通过[kadmin.local => getprinc krbtgt/ HADOOP.COM @ HADOOP.COM]看出来。

进入命令行，将上面的查询出来的两个结果进行赋值即可：重启，正常运行

[root@cdh21 bin]# kadmin.local
Authenticating as principal hue/cdh21@HADOOP.COM with password.
kadmin.local: modprinc -maxrenewlife 90day krbtgt/HADOOP.COM@HADOOP.COM
Principal “krbtgt/HADOOP.COM@HADOOP.COM” modified.
kadmin.local: modprinc -maxrenewlife 90day +allow_renewable hue/cdh21@HADOOP.COM
Principal “hue/cdh21@HADOOP.COM” modified.