You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@oozie.apache.org by Suresh Sangineedi <sa...@gmail.com> on 2011/11/21 19:06:57 UTC
Issue while launching oozie job
Hi
I am using Hadoop version: 0.20.203, and yahoo Oozie version: 3.0.2
Successfully ran the oozie, able to see the oozie webconsole,
But when I try to run the job, I got the Exception, E0902
Oozie.log:
org.apache.oozie.service.AuthorizationException: E0902: Exception occured:
[org.apache.hadoop.ipc.RemoteException: User: oozie is not allowed to
impersonate oozie]
at
org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:320)
at
org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:185)
at
org.apache.oozie.servlet.BaseJobsServlet.doPost(BaseJobsServlet.java:89)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at
org.apache.oozie.servlet.JsonRestServlet.service(JsonRestServlet.java:281)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
at
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
at java.lang.Thread.run(Thread.java:679)
I do have the proxy entries in core-site.xml,
Core-site.xml:
<property>
<name>hadoop.proxyuser.oozie.hosts</name>
<value>*</value>
</property>
<property>
<name>hadoop.proxyuser.oozie.groups</name>
<value>*</value>
</property>
I hadn't enabled the kerberos in hadoop cluster and oozie conf
oozie.service.HadoopAccessorService.kerberos.enabled is set to false
even after setting the above configurations, When I run the oozie job I get
the exception, Exception occured: [org.apache.hadoop.ipc.RemoteException:
User: oozie is not allowed to impersonate oozie
Thanks.
Suresh
Re: Issue while launching oozie job
Posted by tousif <to...@moonraft.com>.
hey i had faced same problem and it was solved after adding this property
in hadoop conf directory
here tousif is user and root is a group . you can change root to users
<property>
<name>hadoop.proxyuser.tousif.groups</name>
<value>root</value>
<description>Allow the superuser oozie to impersonate any
members of the group group1 and group2</description>
</property>
<property>
<name>hadoop.proxyuser.tousif.hosts</name>
<value>localhost</value>
<description>The superuser can connect only from host1 and
host2 to impersonate a user</description>
</property>
On Tue, Nov 22, 2011 at 2:13 AM, Jeremy Hanna <je...@gmail.com>wrote:
> This ticket's patch allows for wildcard permissions which greatly
> simplifies the solution afaik:
> https://issues.apache.org/jira/browse/HADOOP-6995
>
> Some distros like cdh3 have this patch integrated already but I just added
> a comment on that ticket asking whether it could be added to a 0.20.20x
> release since it simplifies things so much for prototyping and for those
> not using permissions.
>
> On Nov 21, 2011, at 2:06 PM, Mohammad Islam wrote:
>
> > The previous discussion on the same issue
> > http://tech.groups.yahoo.com/group/Oozie-users/message/203
> >
> > Regards,
> > Mohammad
> >
> >
> >
> > ________________________________
> > From: Alejandro Abdelnur <tu...@gmail.com>
> > To: oozie-users@incubator.apache.org
> > Sent: Monday, November 21, 2011 12:01 PM
> > Subject: Re: Issue while launching oozie job
> >
> > Suresh,
> >
> > Have you restarted your cluster? Also, the changes in core-site.xml
> > have to be both in the JT and NN configs.
> >
> > Thanks.
> >
> > Alejandro
> > PS: you don't need Kerberos ON for this.
> >
> >
> >
> > On Mon, Nov 21, 2011 at 10:06 AM, Suresh Sangineedi <sa...@gmail.com>
> wrote:
> >> Hi
> >> I am using Hadoop version: 0.20.203, and yahoo Oozie version: 3.0.2
> >> Successfully ran the oozie, able to see the oozie webconsole,
> >> But when I try to run the job, I got the Exception, E0902
> >>
> >> Oozie.log:
> >> org.apache.oozie.service.AuthorizationException: E0902: Exception
> occured:
> >> [org.apache.hadoop.ipc.RemoteException: User: oozie is not allowed to
> >> impersonate oozie]
> >> at
> >>
> org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:320)
> >> at
> >>
> org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:185)
> >> at
> >> org.apache.oozie.servlet.BaseJobsServlet.doPost(BaseJobsServlet.java:89)
> >> at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
> >> at
> >>
> org.apache.oozie.servlet.JsonRestServlet.service(JsonRestServlet.java:281)
> >> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
> >> at
> >>
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
> >> at
> >>
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> >> at
> >>
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
> >> at
> >>
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
> >> at
> >>
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
> >> at
> >>
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
> >> at
> >>
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
> >> at
> >>
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
> >> at
> >>
> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
> >> at
> >>
> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
> >> at
> >> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
> >> at java.lang.Thread.run(Thread.java:679)
> >>
> >> I do have the proxy entries in core-site.xml,
> >> Core-site.xml:
> >> <property>
> >> <name>hadoop.proxyuser.oozie.hosts</name>
> >> <value>*</value>
> >> </property>
> >> <property>
> >> <name>hadoop.proxyuser.oozie.groups</name>
> >> <value>*</value>
> >> </property>
> >>
> >> I hadn't enabled the kerberos in hadoop cluster and oozie conf
> >> oozie.service.HadoopAccessorService.kerberos.enabled is set to false
> >>
> >> even after setting the above configurations, When I run the oozie job I
> get
> >> the exception, Exception occured:
> [org.apache.hadoop.ipc.RemoteException:
> >> User: oozie is not allowed to impersonate oozie
> >>
> >>
> >> Thanks.
> >> Suresh
>
>
--
Regards
Tousif
Re: Issue while launching oozie job
Posted by Jeremy Hanna <je...@gmail.com>.
This ticket's patch allows for wildcard permissions which greatly simplifies the solution afaik: https://issues.apache.org/jira/browse/HADOOP-6995
Some distros like cdh3 have this patch integrated already but I just added a comment on that ticket asking whether it could be added to a 0.20.20x release since it simplifies things so much for prototyping and for those not using permissions.
On Nov 21, 2011, at 2:06 PM, Mohammad Islam wrote:
> The previous discussion on the same issue
> http://tech.groups.yahoo.com/group/Oozie-users/message/203
>
> Regards,
> Mohammad
>
>
>
> ________________________________
> From: Alejandro Abdelnur <tu...@gmail.com>
> To: oozie-users@incubator.apache.org
> Sent: Monday, November 21, 2011 12:01 PM
> Subject: Re: Issue while launching oozie job
>
> Suresh,
>
> Have you restarted your cluster? Also, the changes in core-site.xml
> have to be both in the JT and NN configs.
>
> Thanks.
>
> Alejandro
> PS: you don't need Kerberos ON for this.
>
>
>
> On Mon, Nov 21, 2011 at 10:06 AM, Suresh Sangineedi <sa...@gmail.com> wrote:
>> Hi
>> I am using Hadoop version: 0.20.203, and yahoo Oozie version: 3.0.2
>> Successfully ran the oozie, able to see the oozie webconsole,
>> But when I try to run the job, I got the Exception, E0902
>>
>> Oozie.log:
>> org.apache.oozie.service.AuthorizationException: E0902: Exception occured:
>> [org.apache.hadoop.ipc.RemoteException: User: oozie is not allowed to
>> impersonate oozie]
>> at
>> org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:320)
>> at
>> org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:185)
>> at
>> org.apache.oozie.servlet.BaseJobsServlet.doPost(BaseJobsServlet.java:89)
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
>> at
>> org.apache.oozie.servlet.JsonRestServlet.service(JsonRestServlet.java:281)
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>> at
>> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
>> at
>> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
>> at
>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
>> at
>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
>> at
>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
>> at
>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
>> at
>> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
>> at
>> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
>> at
>> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
>> at java.lang.Thread.run(Thread.java:679)
>>
>> I do have the proxy entries in core-site.xml,
>> Core-site.xml:
>> <property>
>> <name>hadoop.proxyuser.oozie.hosts</name>
>> <value>*</value>
>> </property>
>> <property>
>> <name>hadoop.proxyuser.oozie.groups</name>
>> <value>*</value>
>> </property>
>>
>> I hadn't enabled the kerberos in hadoop cluster and oozie conf
>> oozie.service.HadoopAccessorService.kerberos.enabled is set to false
>>
>> even after setting the above configurations, When I run the oozie job I get
>> the exception, Exception occured: [org.apache.hadoop.ipc.RemoteException:
>> User: oozie is not allowed to impersonate oozie
>>
>>
>> Thanks.
>> Suresh
Re: Issue while launching oozie job
Posted by Mohammad Islam <mi...@yahoo.com>.
The previous discussion on the same issue
http://tech.groups.yahoo.com/group/Oozie-users/message/203
Regards,
Mohammad
________________________________
From: Alejandro Abdelnur <tu...@gmail.com>
To: oozie-users@incubator.apache.org
Sent: Monday, November 21, 2011 12:01 PM
Subject: Re: Issue while launching oozie job
Suresh,
Have you restarted your cluster? Also, the changes in core-site.xml
have to be both in the JT and NN configs.
Thanks.
Alejandro
PS: you don't need Kerberos ON for this.
On Mon, Nov 21, 2011 at 10:06 AM, Suresh Sangineedi <sa...@gmail.com> wrote:
> Hi
> I am using Hadoop version: 0.20.203, and yahoo Oozie version: 3.0.2
> Successfully ran the oozie, able to see the oozie webconsole,
> But when I try to run the job, I got the Exception, E0902
>
> Oozie.log:
> org.apache.oozie.service.AuthorizationException: E0902: Exception occured:
> [org.apache.hadoop.ipc.RemoteException: User: oozie is not allowed to
> impersonate oozie]
> at
> org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:320)
> at
> org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:185)
> at
> org.apache.oozie.servlet.BaseJobsServlet.doPost(BaseJobsServlet.java:89)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
> at
> org.apache.oozie.servlet.JsonRestServlet.service(JsonRestServlet.java:281)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
> at
> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
> at
> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
> at
> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
> at java.lang.Thread.run(Thread.java:679)
>
> I do have the proxy entries in core-site.xml,
> Core-site.xml:
> <property>
> <name>hadoop.proxyuser.oozie.hosts</name>
> <value>*</value>
> </property>
> <property>
> <name>hadoop.proxyuser.oozie.groups</name>
> <value>*</value>
> </property>
>
> I hadn't enabled the kerberos in hadoop cluster and oozie conf
> oozie.service.HadoopAccessorService.kerberos.enabled is set to false
>
> even after setting the above configurations, When I run the oozie job I get
> the exception, Exception occured: [org.apache.hadoop.ipc.RemoteException:
> User: oozie is not allowed to impersonate oozie
>
>
> Thanks.
> Suresh
>
Re: Issue while launching oozie job
Posted by Alejandro Abdelnur <tu...@gmail.com>.
Suresh,
Have you restarted your cluster? Also, the changes in core-site.xml
have to be both in the JT and NN configs.
Thanks.
Alejandro
PS: you don't need Kerberos ON for this.
On Mon, Nov 21, 2011 at 10:06 AM, Suresh Sangineedi <sa...@gmail.com> wrote:
> Hi
> I am using Hadoop version: 0.20.203, and yahoo Oozie version: 3.0.2
> Successfully ran the oozie, able to see the oozie webconsole,
> But when I try to run the job, I got the Exception, E0902
>
> Oozie.log:
> org.apache.oozie.service.AuthorizationException: E0902: Exception occured:
> [org.apache.hadoop.ipc.RemoteException: User: oozie is not allowed to
> impersonate oozie]
> at
> org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:320)
> at
> org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:185)
> at
> org.apache.oozie.servlet.BaseJobsServlet.doPost(BaseJobsServlet.java:89)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
> at
> org.apache.oozie.servlet.JsonRestServlet.service(JsonRestServlet.java:281)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
> at
> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
> at
> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
> at
> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
> at java.lang.Thread.run(Thread.java:679)
>
> I do have the proxy entries in core-site.xml,
> Core-site.xml:
> <property>
> <name>hadoop.proxyuser.oozie.hosts</name>
> <value>*</value>
> </property>
> <property>
> <name>hadoop.proxyuser.oozie.groups</name>
> <value>*</value>
> </property>
>
> I hadn't enabled the kerberos in hadoop cluster and oozie conf
> oozie.service.HadoopAccessorService.kerberos.enabled is set to false
>
> even after setting the above configurations, When I run the oozie job I get
> the exception, Exception occured: [org.apache.hadoop.ipc.RemoteException:
> User: oozie is not allowed to impersonate oozie
>
>
> Thanks.
> Suresh
>
Re: Issue while launching oozie job
Posted by Mohammad Islam <mi...@yahoo.com>.
Hi,
We, at Y!, are mostly using with Kerberos on for both oozie and hadoop.
We never tried without kerberoes. Please see "Caveats" section at http://hadoop.apache.org/common/docs/stable/Secure_Impersonation.html.
Let's see someone from the community reply back.
Regards,
Mohammad
________________________________
From: Suresh Sangineedi <sa...@gmail.com>
To: oozie-users@incubator.apache.org
Sent: Monday, November 21, 2011 10:06 AM
Subject: Issue while launching oozie job
Hi
I am using Hadoop version: 0.20.203, and yahoo Oozie version: 3.0.2
Successfully ran the oozie, able to see the oozie webconsole,
But when I try to run the job, I got the Exception, E0902
Oozie.log:
org.apache.oozie.service.AuthorizationException: E0902: Exception occured:
[org.apache.hadoop.ipc.RemoteException: User: oozie is not allowed to
impersonate oozie]
at
org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:320)
at
org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:185)
at
org.apache.oozie.servlet.BaseJobsServlet.doPost(BaseJobsServlet.java:89)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at
org.apache.oozie.servlet.JsonRestServlet.service(JsonRestServlet.java:281)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
at
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
at java.lang.Thread.run(Thread.java:679)
I do have the proxy entries in core-site.xml,
Core-site.xml:
<property>
<name>hadoop.proxyuser.oozie.hosts</name>
<value>*</value>
</property>
<property>
<name>hadoop.proxyuser.oozie.groups</name>
<value>*</value>
</property>
I hadn't enabled the kerberos in hadoop cluster and oozie conf
oozie.service.HadoopAccessorService.kerberos.enabled is set to false
even after setting the above configurations, When I run the oozie job I get
the exception, Exception occured: [org.apache.hadoop.ipc.RemoteException:
User: oozie is not allowed to impersonate oozie
Thanks.
Suresh