oozie java api submit job, kerberos Authentication error

3
votes

I hava hadoop-2.7 cluster, oozie-4.0.1 running in secure mode(with kerberos). All are well. I can use cli commands submit job as follow:

but I use oozie java api submit job, kerberos exception occur.

Exception in thread "main" AUTHENTICATION : Could not authenticate, GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) at org.apache.oozie.client.AuthOozieClient.createConnection(AuthOozieClient.java:150) at org.apache.oozie.client.OozieClient.getSupportedProtocolVersions(OozieClient.java:577) at org.apache.oozie.client.OozieClient.validateWSVersion(OozieClient.java:538) at org.apache.oozie.client.OozieClient.createURL(OozieClient.java:651) at org.apache.oozie.client.OozieClient.access$100(OozieClient.java:103) at org.apache.oozie.client.OozieClient$ClientCallable.call(OozieClient.java:803) at org.apache.oozie.client.OozieClient.run(OozieClient.java:999) at com.huawei.oozie.OozieMain.main(OozieMain.java:47)

Caused by: org.apache.hadoop.security.authentication.client.AuthenticationException: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator.doSpnegoSequence(KerberosAuthenticator.java:334) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator.authenticate(KerberosAuthenticator.java:206) at org.apache.hadoop.security.authentication.client.AuthenticatedURL.openConnection(AuthenticatedURL.java:215) at org.apache.oozie.client.AuthOozieClient.createConnection(AuthOozieClient.java:144) ... 7 more

Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147) at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:122) at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187) at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:224) at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212) at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator$1.run(KerberosAuthenticator.java:313) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator$1.run(KerberosAuthenticator.java:288) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:422) at org.apache.hadoop.security.authentication.client.KerberosAuthenticator.doSpnegoSequence(KerberosAuthenticator.java:288) ... 10 more

my java code as follow:

System.setProperty("java.security.auth.login.config", System.getProperty("user.dir") + File.separator + "conf"
            + File.separator + "jaas.conf ");
    System.setProperty("java.security.krb5.conf", System.getProperty("user.dir") + File.separator + "conf"
            + File.separator + "krb5.conf ");

    String url = "https://10.137.60.60:21003/oozie";
    AuthOozieClient wc = new AuthOozieClient(url);

    wc.setDebugMode(1);

    Properties conf = wc.createConfiguration();
    FileReader fr = new FileReader("conf/job.properties");
    conf.load(fr);

    System.out.println(conf.toString());
    String jobId = wc.run(conf);
    System.out.println("Workflow job submitted");

    while (wc.getJobInfo(jobId).getStatus() == WorkflowJob.Status.RUNNING)
    {
        System.out.println("Workflow job running ...");
        Thread.sleep(3 * 1000);
    }

    System.out.println("Workflow job completed ...");
    System.out.println(wc.getJobInfo(jobId));

my conf/jaas.conf as follow:

Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="D:/workspace/4.4-billing/Oozie/conf/oozie.keytab"
principal="[email protected]"
useTicketCache=false
storeKey=true
debug=true;
};

can anyone help me ? I know oozie use hadoop-auth jar. but how to set keytab, write authenticate code, I cannot.

1
kerberosoozie
1. enable Java Security debug mode with -Djava.security.debug=configfile,gssloginconfig,configparser,logincontext 2. check the encryption algorithms used by your JVM; Kerberos typically requires AES256 (not included by Oracle/Sun JRE by default, must download "unlimited strength crypto" policy JARs) 3. for a Windows path try keyTab="D:\\workspace\\4.4-billing\\Oozie\\conf\\oozie.keytab" – Samson Scharfrichter
@SamsonScharfrichter Your advice on the "unlimited strength crypto" policy JARs did the trick for me. Just before that I had not been able to make Oozie Client API work on Centos7 Oracle jre 1.8. – kasur
@kasur, a must-read if you have a Kerberized Hadoop cluster: steveloughran.gitbooks.io/kerberos_and_hadoop/content/… – Samson Scharfrichter

1 Answers

0
votes

set your kerberos user account as 

conf.setProperty(OozieClient.USER_NAME, "xyz");
oozieClient.run(conf);