配置好hue+kerberos后,启动报错:
[19/Jan/2018 07:10:08 +0000] kt_renewer INFO Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:08 +0000] kt_renewer ERROR Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/node1@EXAMPLE.COM' is still renewable:
$ klist -f -c /var/run/hue/hue_krb5_ccache
If the 'renew until' date is the same as the 'valid starting' date, the ticket cannot be renewed. Please check your KDC configuration, and the ticket renewal policy (maxrenewlife) for the 'hue/node1@EXAMPLE.COM' and `krbtgt' principals.
[19/Jan/2018 23:10:09 +0000] settings DEBUG DESKTOP_DB_TEST_NAME SET: /usr/local/hue/desktop/desktop-test.db
[19/Jan/2018 23:10:09 +0000] settings DEBUG DESKTOP_DB_TEST_USER SET: hue_test
[19/Jan/2018 07:10:09 +0000] __init__ INFO Couldn't import snappy. Support for snappy compression disabled.
[19/Jan/2018 07:10:09 +0000] kt_renewer INFO Reinitting kerberos from keytab: /usr/bin/kinit -k -t /etc/security/keytabs/hue.service.keytab -c /var/run/hue/hue_krb5_ccache hue/node1@EXAMPLE.COM
[19/Jan/2018 07:10:10 +0000] kt_renewer INFO Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:10 +0000] kt_renewer ERROR Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/node1@EXAMPLE.COM' is still renewable:
执行klist提示:
[root@node1 bin]# klist -f -c /var/run/hue/hue_krb5_ccache
Ticket cache: FILE:/var/run/hue/hue_krb5_ccache
Default principal: hue/node1@EXAMPLE.COM
Valid starting Expires Service principal
01/19/2018 23:06:26 01/20/2018 23:06:26 krbtgt/EXAMPLE.COM@EXAMPLE.COM
找到解决方案:
http://www.cloudera.com/documentation/manager/5-1-x/Configuring-Hadoop-Security-with-Cloudera-Manager/cm5chs_enable_hue_sec_s10.html
[root@node1 bin]# kadmin.local
Authenticating as principal hue/admin@EXAMPLE.COM with password.
kadmin.local: modprinc -maxrenewlife 90day krbtgt/EXAMPLE.COM@EXAMPLE.COM
Principal "krbtgt/EXAMPLE.COM@EXAMPLE.COM" modified.
kadmin.local: modprinc -maxrenewlife 90day +allow_renewable hue/node1@EXAMPLE.COM
Principal "hue/node1@EXAMPLE.COM" modified.
另一种解决方法:
https://community.cloudera.com/t5/Cloudera-Manager-Installation/Hue-Kerberos-error-quot-TICKET-NOT-RENEWABLE-quot/m-p/6731#M828
即在/etc/krb5.conf加入:
[libdefaults]
default_realm = TEST.LAB
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true