Hadoop集成kerberos后,报错:AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]

素颜马尾好姑娘i 2022-11-14 10:23 194阅读 0赞

# 1. 背景 #

Hadoop在安装完HDFS之后, WEB UI 访问正常.kinit -kt xxx 认证成功.  
然后在命令行执行执行hadoop相关指令的时候,报错.

# 2. 报错信息 #

错误信息 : AccessControlException: Client cannot authenticate via:\[TOKEN, KERBEROS\]

[root@master01 ~]# klist
    Ticket cache: KEYRING:persistent:0:krb_ccache_MkHX3zi
    Default principal: root/master01@HENGHE.COM
    
    Valid starting       Expires              Service principal
    2021-03-28T17:35:19  2021-03-29T17:35:19  krbtgt/HENGHE.COM@HENGHE.COM
    [root@master01 ~]#
    [root@master01 ~]# hadoop fs -ls /
    2021-03-28 20:23:27,667 WARN ipc.Client: Exception encountered while connecting to the server : org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
    ls: DestHost:destPort master01:8020 , LocalHost:localPort master01/192.xx.xx:0. Failed on local exception: java.io.IOException: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]

# 3. 解决方式 #

修改 Kerboeros配置文件 `/etc/krb5.conf` , 注释掉 : default\_ccache\_name 属性 .  
然后执行kdestroy,重新kinit .

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3poYW5nbG9uZ180NDQ0_size_16_color_FFFFFF_t_70]

*  销毁&重新认证指令:

# 销毁
    kdestroy
    
    #重新认证
     kinit -kt /opt/keytab/root.keytab root/master01@HENGHE.COM

# 4. 验证 #

[root@master01 ~]# hadoop fs -ls /
    Found 2 items
    drwxr-xr-x   - root supergroup          0 2021-03-25 22:51 /tmp
    drwx------   - root supergroup          0 2021-03-26 10:59 /user
    [root@master01 ~]#

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3poYW5nbG9uZ180NDQ0_size_16_color_FFFFFF_t_70]: /images/20221022/14b1fac1fbb54bf8a37d91767f1fd2ba.png