hadoop - AWS EMR kerberizing 集群 hadoop.security.AccessControlException

Question

我正在尝试对 AWS EMR 集群进行 Kerberize。我启用了 hadoop 安全性，创建了 kerberos 主体并将它们部署在所有节点上。

但是，当我使用命令“sudo start hadoop-hdfs-namenode”启动名称节点时，会抛出以下异常。

2016-06-08 06:14:06,515 INFO org.apache.hadoop.hdfs.server.blockmanagement.DatanodeDescriptor (main): Number of failed storage changes from 0 to 0 2016-06-08 06:14:06,515 INFO org.apache.hadoop.hdfs.security.token.block.BlockTokenSecretManager (org.apache.hadoop.hdfs.server.blockmanagement.HeartbeatManager$Monitor@ac4860): Updating block keys 2016-06-08 06:14:06,544 INFO org.apache.hadoop.ipc.Server (IPC Server Responder): IPC Server Responder: starting 2016-06-08 06:14:06,544 INFO org.apache.hadoop.ipc.Server (IPC Server listener on 8020): IPC Server listener on 8020: starting 2016-06-08 06:14:06,560 INFO org.apache.hadoop.hdfs.server.namenode.NameNode (main): NameNode RPC up at: ip-172-31-21-213.ap-southeast-1.compute.internal/172.31.21.213:8020 2016-06-08 06:14:06,560 INFO org.apache.hadoop.hdfs.server.namenode.FSNamesystem (main): Starting services required for active state 2016-06-08 06:14:06,564 INFO org.apache.hadoop.hdfs.server.blockmanagement.CacheReplicationMonitor (CacheReplicationMonitor(443740501)): Starting CacheReplicationMonitor with interval 30000 milliseconds 2016-06-08 06:14:06,763 INFO org.apache.hadoop.ipc.Server (Socket Reader #1 for port 8020): Socket Reader #1 for port 8020: readAndProcess from client 172.31.21.213 threw exception [org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS]] org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS] at org.apache.hadoop.ipc.Server$Connection.initializeAuthContext(Server.java:1564) at org.apache.hadoop.ipc.Server$Connection.readAndProcess(Server.java:1520) at org.apache.hadoop.ipc.Server$Listener.doRead(Server.java:771) at org.apache.hadoop.ipc.Server$Listener$Reader.doRunLoop(Server.java:637) at org.apache.hadoop.ipc.Server$Listener$Reader.run(Server.java:608)

请在这方面帮助我。提前致谢。

Answer 1

客户端认为没有启用安全；它只是试图使用“SIMPLE”身份验证 - 来电者就是他们所说的人。服务器将只获取 Kerberos 票证或 Hadoop 委托(delegate) token ，该 token 先前由具有有效 Kerberos 票证的调用方获取。