nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From DEHAY Aurelien <aurelien.de...@faurecia.com>
Subject Kerberized PutKudu
Date Thu, 01 Aug 2019 14:53:35 GMT
Classification\_- INTERNAL & PARTNERS

Hello.

I still have some issues with the kerberized PutKudu on my 1.9.2 nifi cluster:

2019-08-01 16:15:28,207 DEBUG [Timer-Driven Process Thread-64] o.a.n.security.krb.AbstractKerberosUser
TGT was found, but has not reached expiration window
2019-08-01 16:15:28,279 WARN [New I/O worker #36] org.apache.kudu.util.NetUtil Slow DNS lookup!
Resolved IP of `par01prdmgt2.soft.fau' to par01prdmgt2.soft.fau/10.126.94.77 in 3731271ns
2019-08-01 16:15:28,291 WARN [New I/O worker #37] org.apache.kudu.client.SecurityContext Caller-provided
Subject has a Kerberos ticket that is about to expire. Kudu expects the application to renew
or re-acquire its own tickets before expiration.
2019-08-01 16:15:28,321 WARN [New I/O worker #37] org.apache.kudu.client.AsyncKuduSession
unexpected tablet lookup failure for operation KuduRpc(method=Write, tablet=null, attempt=0,
DeadlineTracker(timeout=0, elapsed=113), No traces)
org.apache.kudu.client.NonRecoverableException: cannot re-acquire authentication token after
5 attempts (Couldn't find a valid master in (par01prdmgt1.soft.fau:7051,par01prdmgt2.soft.fau:7051,par01prdmgt3.soft.fau:7051).
Exceptions received: [org.apache.kudu.client.NonRecoverableException: server requires authentication,
but client does not have Kerberos credentials (tgt). Authentication tokens were not used because
this connection will be used to acquire a new token and therefore requires primary credentials,
org.apache.kudu.client.NonRecoverableException: server requires authentication, but client
does not have Kerberos credentials (tgt). Authentication tokens were not used because this
connection will be used to acquire a new token and therefore requires primary credentials,
org.apache.kudu.client.NonRecoverableException: server requires authentication, but client
does not have Kerberos credentials (tgt). Authentication tokens were not used because this
connection will be used to acquire a new token and therefore requires primary credentials])
        at org.apache.kudu.client.AuthnTokenReacquirer$1NewAuthnTokenErrB.call(AuthnTokenReacquirer.java:158)
        at org.apache.kudu.client.AuthnTokenReacquirer$1NewAuthnTokenErrB.call(AuthnTokenReacquirer.java:141)
        at com.stumbleupon.async.Deferred.doCall(Deferred.java:1280)
        at com.stumbleupon.async.Deferred.runCallbacks(Deferred.java:1259)
        at com.stumbleupon.async.Deferred.callback(Deferred.java:1002)
        at org.apache.kudu.client.ConnectToCluster.incrementCountAndCheckExhausted(ConnectToCluster.java:246)
        at org.apache.kudu.client.ConnectToCluster.access$100(ConnectToCluster.java:49)
        at org.apache.kudu.client.ConnectToCluster$ConnectToMasterErrCB.call(ConnectToCluster.java:365)
        at org.apache.kudu.client.ConnectToCluster$ConnectToMasterErrCB.call(ConnectToCluster.java:354)Aurélien
DEHAY


I restart the processors and everything works just fine again. I have this error every approximatively
7 days. I don't know if it's a processor Kerberos configuration (even if in the keytab Kerberos
service there is not much conf), the kerberos conf of the server or the Kerberos service.

Any pointer would greatly help, thanks.

Aurélien.

This electronic transmission (and any attachments thereto) is intended solely for the use
of the addressee(s). It may contain confidential or legally privileged information. If you
are not the intended recipient of this message, you must delete it immediately and notify
the sender. Any unauthorized use or disclosure of this message is strictly prohibited.  Faurecia
does not guarantee the integrity of this transmission and shall therefore never be liable
if the message is altered or falsified nor for any virus, interception or damage to your system.


Mime
View raw message