HUE+kerberos启动报错Couldn't renew kerberos ticket解决方案

阳光穿透心脏的1/2处 2022-06-01 04:40 596阅读 0赞

配置好hue+kerberos后，启动报错：

[19/Jan/2018 07:10:08 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
    kinit: KDC can't fulfill requested option while renewing credentials
    [19/Jan/2018 07:10:08 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/node1@EXAMPLE.COM' is still renewable:
      $ klist -f -c /var/run/hue/hue_krb5_ccache
    If the 'renew until' date is the same as the 'valid starting' date, the ticket cannot be renewed. Please check your KDC configuration, and the ticket renewal policy (maxrenewlife) for the 'hue/node1@EXAMPLE.COM' and `krbtgt' principals.
    [19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_NAME SET: /usr/local/hue/desktop/desktop-test.db
    [19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_USER SET: hue_test
    [19/Jan/2018 07:10:09 +0000] __init__     INFO     Couldn't import snappy. Support for snappy compression disabled.
    [19/Jan/2018 07:10:09 +0000] kt_renewer   INFO     Reinitting kerberos from keytab: /usr/bin/kinit -k -t /etc/security/keytabs/hue.service.keytab -c /var/run/hue/hue_krb5_ccache hue/node1@EXAMPLE.COM
    [19/Jan/2018 07:10:10 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
    kinit: KDC can't fulfill requested option while renewing credentials
    [19/Jan/2018 07:10:10 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/node1@EXAMPLE.COM' is still renewable:

执行klist提示：

[root@node1 bin]# klist -f -c /var/run/hue/hue_krb5_ccache
    Ticket cache: FILE:/var/run/hue/hue_krb5_ccache
    Default principal: hue/node1@EXAMPLE.COM
    
    Valid starting       Expires              Service principal
    01/19/2018 23:06:26  01/20/2018 23:06:26  krbtgt/EXAMPLE.COM@EXAMPLE.COM

找到解决方案：

http://www.cloudera.com/documentation/manager/5-1-x/Configuring-Hadoop-Security-with-Cloudera-Manager/cm5chs\_enable\_hue\_sec\_s10.html

[root@node1 bin]# kadmin.local
    Authenticating as principal hue/admin@EXAMPLE.COM with password.
    kadmin.local:   modprinc -maxrenewlife 90day krbtgt/EXAMPLE.COM@EXAMPLE.COM
    Principal "krbtgt/EXAMPLE.COM@EXAMPLE.COM" modified.
    kadmin.local:  modprinc -maxrenewlife 90day +allow_renewable hue/node1@EXAMPLE.COM
    Principal "hue/node1@EXAMPLE.COM" modified.

另一种解决方法：

https://community.cloudera.com/t5/Cloudera-Manager-Installation/Hue-Kerberos-error-quot-TICKET-NOT-RENEWABLE-quot/m-p/6731\#M828

即在/etc/krb5.conf加入：

[libdefaults]
       default_realm = TEST.LAB
       dns_lookup_realm = false
       dns_lookup_kdc = false
     ticket_lifetime = 24h renew_lifetime = 7d forwardable = true