You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-issues@hadoop.apache.org by "Steve Loughran (JIRA)" <ji...@apache.org> on 2014/10/22 16:28:34 UTC
[jira] [Commented] (YARN-2700) TestSecureRMRegistryOperations
failing on windows: auth problems
[ https://issues.apache.org/jira/browse/YARN-2700?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14179953#comment-14179953 ]
Steve Loughran commented on YARN-2700:
--------------------------------------
logs
{code}
2014-10-21 03:25:26,022 [NIOServerCxn.Factory:localhost/127.0.0.1:0] INFO server.NIOServerCnxnFactory (NIOServerCnxnFactory.java:run(197)) - Accepted socket connection from /127.0.0.1:49869
2014-10-21 03:25:26,024 [JUnit-SendThread(127.0.0.1:49864)] DEBUG zookeeper.ClientCnxn (ClientCnxn.java:primeConnection(892)) - Session establishment request sent on 127.0.0.1/127.0.0.1:49864
Found KeyTab
Found KerberosKey for zookeeper/localhost@EXAMPLE.COM
Found KerberosKey for zookeeper/localhost@EXAMPLE.COM
Found KerberosKey for zookeeper/localhost@EXAMPLE.COM
Found KerberosKey for zookeeper/localhost@EXAMPLE.COM
Found KerberosKey for zookeeper/localhost@EXAMPLE.COM
2014-10-21 03:25:26,035 [NIOServerCxn.Factory:localhost/127.0.0.1:0] INFO server.ZooKeeperServer (ZooKeeperServer.java:processConnectRequest(868)) - Client attempting to establish new session at /127.0.0.1:49869
2014-10-21 03:25:26,039 [SyncThread:0] INFO persistence.FileTxnLog (FileTxnLog.java:append(199)) - Creating new log file: log.1
2014-10-21 03:25:26,057 [SyncThread:0] INFO server.ZooKeeperServer (ZooKeeperServer.java:finishSessionInit(617)) - Established session 0x149323d68820000 with negotiated timeout 60000 for client /127.0.0.1:49869
2014-10-21 03:25:26,059 [JUnit-SendThread(127.0.0.1:49864)] INFO zookeeper.ClientCnxn (ClientCnxn.java:onConnected(1235)) - Session establishment complete on server 127.0.0.1/127.0.0.1:49864, sessionid = 0x149323d68820000, negotiated timeout = 60000
Found ticket for zookeeper@EXAMPLE.COM to go to krbtgt/EXAMPLE.COM@EXAMPLE.COM expiring on Wed Oct 22 03:25:25 PDT 2014
Entered Krb5Context.initSecContext with state=STATE_NEW
Found ticket for zookeeper@EXAMPLE.COM to go to krbtgt/EXAMPLE.COM@EXAMPLE.COM expiring on Wed Oct 22 03:25:25 PDT 2014
Service ticket not found in the subject
KrbException: Server not found in Kerberos database (7) - Server not found in Kerberos database
at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:73)
at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:192)
at sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:203)
at sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:309)
at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:115)
at sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:454)
at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:641)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:193)
at org.apache.zookeeper.client.ZooKeeperSaslClient$2.run(ZooKeeperSaslClient.java:366)
at org.apache.zookeeper.client.ZooKeeperSaslClient$2.run(ZooKeeperSaslClient.java:363)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:415)
at org.apache.zookeeper.client.ZooKeeperSaslClient.createSaslToken(ZooKeeperSaslClient.java:362)
at org.apache.zookeeper.client.ZooKeeperSaslClient.createSaslToken(ZooKeeperSaslClient.java:348)
at org.apache.zookeeper.client.ZooKeeperSaslClient.sendSaslPacket(ZooKeeperSaslClient.java:420)
at org.apache.zookeeper.client.ZooKeeperSaslClient.initialize(ZooKeeperSaslClient.java:458)
at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1013)
Caused by: KrbException: Identifier doesn't match expected value (906)
at sun.security.krb5.internal.KDCRep.init(KDCRep.java:143)
at sun.security.krb5.internal.TGSRep.init(TGSRep.java:66)
at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:61)
at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
... 18 more
2014-10-21 03:25:26,145 [JUnit-SendThread(127.0.0.1:49864)] ERROR client.ZooKeeperSaslClient (ZooKeeperSaslClient.java:createSaslToken(384)) - An error: (java.security.PrivilegedActionException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]) occurred when evaluating Zookeeper Quorum Member's received SASL token. Zookeeper Client will go to AUTH_FAILED state.
2014-10-21 03:25:26,146 [JUnit-SendThread(127.0.0.1:49864)] ERROR zookeeper.ClientCnxn (ClientCnxn.java:run(1015)) - SASL authentication with Zookeeper Quorum member failed: javax.security.sasl.SaslException: An error: (java.security.PrivilegedActionException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]) occurred when evaluating Zookeeper Quorum Member's received SASL token. Zookeeper Client will go to AUTH_FAILED state.
2014-10-21 03:25:26,146 [JUnit-EventThread] ERROR curator.ConnectionState (ConnectionState.java:checkState(245)) - Authentication failed
2014-10-21 03:25:26,169 [NIOServerCxn.Factory:localhost/127.0.0.1:0] WARN server.NIOServerCnxn (NIOServerCnxn.java:doIO(357)) - caught end of stream exception
EndOfStreamException: Unable to read additional data from client sessionid 0x149323d68820000, likely client has closed socket
at org.apache.zookeeper.server.NIOServerCnxn.doIO(NIOServerCnxn.java:228)
at org.apache.zookeeper.server.NIOServerCnxnFactory.run(NIOServerCnxnFactory.java:208)
at java.lang.Thread.run(Thread.java:745)
2014-10-21 03:25:26,172 [NIOServerCxn.Factory:localhost/127.0.0.1:0] INFO server.NIOServerCnxn (NIOServerCnxn.java:closeSock(1007)) - Closed socket connection for client /127.0.0.1:49869 which had sessionid 0x149323d68820000
2014-10-21 03:25:26,175 [JUnit] DEBUG service.AbstractService (AbstractService.java:noteFailure(261)) - noteFailure org.apache.hadoop.registry.client.exceptions.AuthenticationFailedException: `/registry': Authentication Failed: org.apache.zookeeper.KeeperException$AuthFailedException: KeeperErrorCode = AuthFailed for /registry; secure cluster; secure registry; Curator service access policy: sasl; System ACLs:
0x01: 'world,'anyone
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
User: zookeeper@EXAMPLE.COM: zookeeper@EXAMPLE.COM (auth:KERBEROS) hasKerberosCredentials=true isFromKeytab=true kerberos is enabled in Hadoop =true; Kerberos Realm: EXAMPLE.COM; java.security.auth.login.config=C:\Work\hadoop-trunk\hadoop-yarn-project\hadoop-yarn\hadoop-yarn-registry\target\kdc\jaas.txt; zookeeper.sasl.client=true; JAAS Client Identity=zookeeper; hadoop.registry.jaas.context=zookeeper; ; zookeeper.sasl.client.username=zookeeper; zookeeper.sasl.clientconfig=zookeeper; zookeeper.allowSaslFailedClients=true; zookeeper.maintain_connection_despite_sasl_failure=false: KeeperErrorCode = AuthFailed for /registry
2014-10-21 03:25:26,175 [JUnit] INFO service.AbstractService (AbstractService.java:noteFailure(272)) - Service rmregistry failed in state STARTED; cause: org.apache.hadoop.registry.client.exceptions.AuthenticationFailedException: `/registry': Authentication Failed: org.apache.zookeeper.KeeperException$AuthFailedException: KeeperErrorCode = AuthFailed for /registry; secure cluster; secure registry; Curator service access policy: sasl; System ACLs:
0x01: 'world,'anyone
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
User: zookeeper@EXAMPLE.COM: zookeeper@EXAMPLE.COM (auth:KERBEROS) hasKerberosCredentials=true isFromKeytab=true kerberos is enabled in Hadoop =true; Kerberos Realm: EXAMPLE.COM; java.security.auth.login.config=C:\Work\hadoop-trunk\hadoop-yarn-project\hadoop-yarn\hadoop-yarn-registry\target\kdc\jaas.txt; zookeeper.sasl.client=true; JAAS Client Identity=zookeeper; hadoop.registry.jaas.context=zookeeper; ; zookeeper.sasl.client.username=zookeeper; zookeeper.sasl.clientconfig=zookeeper; zookeeper.allowSaslFailedClients=true; zookeeper.maintain_connection_despite_sasl_failure=false: KeeperErrorCode = AuthFailed for /registry
org.apache.hadoop.registry.client.exceptions.AuthenticationFailedException: `/registry': Authentication Failed: org.apache.zookeeper.KeeperException$AuthFailedException: KeeperErrorCode = AuthFailed for /registry; secure cluster; secure registry; Curator service access policy: sasl; System ACLs:
0x01: 'world,'anyone
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
0x1f: 'sasl,'zookeeper@EXAMPLE.COM
User: zookeeper@EXAMPLE.COM: zookeeper@EXAMPLE.COM (auth:KERBEROS) hasKerberosCredentials=true isFromKeytab=true kerberos is enabled in Hadoop =true; Kerberos Realm: EXAMPLE.COM; java.security.auth.login.config=C:\Work\hadoop-trunk\hadoop-yarn-project\hadoop-yarn\hadoop-yarn-registry\target\kdc\jaas.txt; zookeeper.sasl.client=true; JAAS Client Identity=zookeeper; hadoop.registry.jaas.context=zookeeper; ; zookeeper.sasl.client.username=zookeeper; zookeeper.sasl.clientconfig=zookeeper; zookeeper.allowSaslFailedClients=true; zookeeper.maintain_connection_despite_sasl_failure=false: KeeperErrorCode = AuthFailed for /registry
at org.apache.hadoop.registry.client.impl.zk.CuratorService.operationFailure(CuratorService.java:386)
at org.apache.hadoop.registry.client.impl.zk.CuratorService.zkMkPath(CuratorService.java:552)
at org.apache.hadoop.registry.client.impl.zk.CuratorService
{code}
> TestSecureRMRegistryOperations failing on windows: auth problems
> ----------------------------------------------------------------
>
> Key: YARN-2700
> URL: https://issues.apache.org/jira/browse/YARN-2700
> Project: Hadoop YARN
> Issue Type: Sub-task
> Components: api, resourcemanager
> Affects Versions: 2.6.0
> Environment: Windows Server, Win7
> Reporter: Steve Loughran
> Assignee: Steve Loughran
>
> TestSecureRMRegistryOperations failing on windows: unable to create the root /registry path with permissions problems.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)