HUE+kerberos启动报错Couldn't renew kerberos ticket解决方案

配置好hue+kerberos后，启动报错：

[19/Jan/2018 07:10:08 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:08 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/node1@EXAMPLE.COM' is still renewable:
  $ klist -f -c /var/run/hue/hue_krb5_ccache
If the 'renew until' date is the same as the 'valid starting' date, the ticket cannot be renewed. Please check your KDC configuration, and the ticket renewal policy (maxrenewlife) for the 'hue/node1@EXAMPLE.COM' and `krbtgt' principals.
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_NAME SET: /usr/local/hue/desktop/desktop-test.db
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_USER SET: hue_test
[19/Jan/2018 07:10:09 +0000] __init__     INFO     Couldn't import snappy. Support for snappy compression disabled.
[19/Jan/2018 07:10:09 +0000] kt_renewer   INFO     Reinitting kerberos from keytab: /usr/bin/kinit -k -t /etc/security/keytabs/hue.service.keytab -c /var/run/hue/hue_krb5_ccache hue/node1@EXAMPLE.COM
[19/Jan/2018 07:10:10 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:10 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/node1@EXAMPLE.COM' is still renewable:

执行klist提示：

[root@node1 bin]# klist -f -c /var/run/hue/hue_krb5_ccache
Ticket cache: FILE:/var/run/hue/hue_krb5_ccache
Default principal: hue/node1@EXAMPLE.COM

Valid starting       Expires              Service principal
01/19/2018 23:06:26  01/20/2018 23:06:26  krbtgt/EXAMPLE.COM@EXAMPLE.COM

找到解决方案：

http://www.cloudera.com/documentation/manager/5-1-x/Configuring-Hadoop-Security-with-Cloudera-Manager/cm5chs_enable_hue_sec_s10.html

[root@node1 bin]# kadmin.local
Authenticating as principal hue/admin@EXAMPLE.COM with password.
kadmin.local:   modprinc -maxrenewlife 90day krbtgt/EXAMPLE.COM@EXAMPLE.COM
Principal "krbtgt/EXAMPLE.COM@EXAMPLE.COM" modified.
kadmin.local:  modprinc -maxrenewlife 90day +allow_renewable hue/node1@EXAMPLE.COM
Principal "hue/node1@EXAMPLE.COM" modified.

另一种解决方法：

https://community.cloudera.com/t5/Cloudera-Manager-Installation/Hue-Kerberos-error-quot-TICKET-NOT-RENEWABLE-quot/m-p/6731#M828

即在/etc/krb5.conf加入：

[libdefaults]
   default_realm = TEST.LAB
   dns_lookup_realm = false
   dns_lookup_kdc = false
   ticket_lifetime = 24h
   renew_lifetime = 7d
   forwardable = true