hadoop - Active Directory-Hortonworks跨领域信任建立-6ren

hadoop - Active Directory-Hortonworks跨领域信任建立

转载作者：行者123 更新时间：2023-12-02 20:26:21

我们正在尝试为SAS Hadoop数据加载器(DLH)配置IWA。 SAS服务器在Active Directory域下运行，并且SSO已成功配置。我们需要配置DLH，以使用客户端生成的票证与Hortonworks Hadoop MIT Kerberos进行通信。该功能不起作用。

因此，基本上，我们在AD(ABC.COM)和Hadoop MIT Kerberos(xyz-Hadoop Realm 名称没有任何FQDN，而且都是小写字母)2方式信任建立中遇到问题。我们已经按照以下链接(https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.6.0/bk_security/content/kerb-config-realm-kdc.html)确认了信任关系，并且一切正常，但是以某种方式使用AD的HTTP票证，我们无法登录到hadoop并收到以下错误消息:

com.sas.svcs.dm.hadoop.spi.exception.HadoopConfigurationException: Failed to find GSSCredential. Check Kerberos configuration

我们已经尝试了很多故障排除方法。现在终于可以确定我们之间存在信任问题，并测试以下要求执行的步骤。

在SAS服务器(Linux)上

kinit -f HTTP/xxx.abc.com@ABC.COM

klist -eaf

kvno hive/xyz@xyz

如果上述所有步骤均有效，则表示我们已启用信任

这是我们看到的错误

kvno: KDC returned error string: PROCESS_TGS while getting credentials for hive/xyz@xyz

和

kvno: Decrypt integrity check failed while getting credentials for hive/xyz@xyz

kinit -f HTTP/xxx.abc.com@ABC.COM (this works fine)


# kinit -k -t xxx.host.keytab HTTP/xxx.abc.com@ABC.COM
[65181] 1559895039.846538: Getting initial credentials for HTTP/xxx.abc.com@ABC.COM
[65181] 1559895039.846539: Looked up etypes in keytab: des-cbc-crc, des, des-cbc-crc, rc4-hmac, aes256-cts, aes128-cts
[65181] 1559895039.846541: Sending unauthenticated request
[65181] 1559895039.846542: Sending request (220 bytes) to ABC.COM
[65181] 1559895039.846543: Sending initial UDP request to dgram 10.68.5.219:88
[65181] 1559895039.846544: Received answer (819 bytes) from dgram 10.68.5.219:88
[65181] 1559895039.846545: Response was from master KDC
[65181] 1559895039.846546: Processing preauth types: PA-ETYPE-INFO2 (19)
[65181] 1559895039.846547: Selected etype info: etype aes256-cts, salt "ABC.COMHTTPxxx.abc.com", params ""
[65181] 1559895039.846548: Produced preauth for next request: (empty)
[65181] 1559895039.846549: Getting AS key, salt "ABC.COMHTTPxxx.abc.com", params ""
[65181] 1559895039.846550: Retrieving HTTP/xxx.abc.com@ABC.COM from FILE:xxx.host.keytab (vno 0, enctype aes256-cts) with result: 0/Success
[65181] 1559895039.846551: AS key obtained from gak_fct: aes256-cts/8AEB
[65181] 1559895039.846552: Decrypted AS reply; session key is: aes256-cts/E734
[65181] 1559895039.846553: FAST negotiation: unavailable
[65181] 1559895039.846554: Initializing FILE:/tmp/krb5cc_0 with default princ HTTP/xxx.abc.com@ABC.COM
[65181] 1559895039.846555: Storing HTTP/xxx.abc.com@ABC.COM -> krbtgt/ABC.COM@ABC.COM in FILE:/tmp/krb5cc_0

##########################################################

klist -e (this shows the ticket is generated)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# klist -e
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: HTTP/xxx.abc.com@ABC.COM

Valid starting       Expires              Service principal
06/07/2019 13:40:39  06/07/2019 13:50:39  krbtgt/ABC.COM@ABC.COM
        Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96

###########################################################


kvno hive/xyz@xyz (this command fails)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# kvno hive/xyz@xyz
[65247] 1559895064.242178: Getting credentials HTTP/xxx.abc.com@ABC.COM -> hive/xyz@xyz using ccache FILE:/tmp/krb5cc_0
[65247] 1559895064.242179: Retrieving HTTP/xxx.abc.com@ABC.COM -> hive/xyz@xyz from FILE:/tmp/krb5cc_0 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_0)
[65247] 1559895064.242180: Retrieving HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@xyz from FILE:/tmp/krb5cc_0 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_0)
[65247] 1559895064.242181: Retrieving HTTP/xxx.abc.com@ABC.COM -> krbtgt/ABC.COM@ABC.COM from FILE:/tmp/krb5cc_0 with result: 0/Success
[65247] 1559895064.242182: Starting with TGT for client realm: HTTP/xxx.abc.com@ABC.COM -> krbtgt/ABC.COM@ABC.COM
[65247] 1559895064.242183: Retrieving HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@xyz from FILE:/tmp/krb5cc_0 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_0)
[65247] 1559895064.242184: Requesting TGT krbtgt/xyz@ABC.COM using TGT krbtgt/ABC.COM@ABC.COM
[65247] 1559895064.242185: Generated subkey for TGS request: aes256-cts/C142
[65247] 1559895064.242186: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[65247] 1559895064.242188: Encoding request body and padata into FAST request
[65247] 1559895064.242189: Sending request (1001 bytes) to ABC.COM
[65247] 1559895064.242190: Sending initial UDP request to dgram 10.68.5.219:88
[65247] 1559895064.242191: Received answer (873 bytes) from dgram 10.68.5.219:88
[65247] 1559895064.242192: Response was from master KDC
[65247] 1559895064.242193: Decoding FAST response
[65247] 1559895064.242194: FAST reply key: aes256-cts/9192
[65247] 1559895064.242195: TGS reply is for HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@ABC.COM with session key des-cbc-crc/330F
[65247] 1559895064.242196: TGS request result: 0/Success
[65247] 1559895064.242197: Storing HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@ABC.COM in FILE:/tmp/krb5cc_0
[65247] 1559895064.242198: Received TGT for service realm: krbtgt/xyz@ABC.COM
[65247] 1559895064.242199: Requesting tickets for hive/xyz@xyz, referrals on
[65247] 1559895064.242200: Generated subkey for TGS request: des-cbc-crc/FB8F
[65247] 1559895064.242201: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[65247] 1559895064.242203: Encoding request body and padata into FAST request
[65247] 1559895064.242204: Sending request (935 bytes) to xyz
[65247] 1559895064.242205: Resolving hostname xyz
[65247] 1559895064.242206: Sending initial UDP request to dgram 10.68.166.7:88
[65247] 1559895064.242207: Received answer (138 bytes) from dgram 10.68.166.7:88
[65247] 1559895064.242208: Response was not from master KDC
[65247] 1559895064.242209: TGS request result: -1765328324/KDC returned error string: PROCESS_TGS
[65247] 1559895064.242210: Requesting tickets for hive/xyz@xyz, referrals off
[65247] 1559895064.242211: Generated subkey for TGS request: des-cbc-crc/01C2
[65247] 1559895064.242212: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[65247] 1559895064.242214: Encoding request body and padata into FAST request
[65247] 1559895064.242215: Sending request (935 bytes) to xyz
[65247] 1559895064.242216: Resolving hostname xyz
[65247] 1559895064.242217: Sending initial UDP request to dgram 10.68.166.7:88
[65247] 1559895064.242218: Received answer (138 bytes) from dgram 10.68.166.7:88
[65247] 1559895064.242219: Response was not from master KDC
[65247] 1559895064.242220: TGS request result: -1765328324/KDC returned error string: PROCESS_TGS
kvno: KDC returned error string: PROCESS_TGS while getting credentials for hive/xyz@xyz

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@


Also just for troubleshooting I add enctypes on my AD server using the following command:

ksetup /SetEncTypeAttr xyz DES-CBC-CRC DES-CBC-MD5 RC4-HMAC-MD5 AES128-CTS-HMAC-SHA1-96 AES256-CTS-HMAC-SHA1-96

So, after running the above command when I try to run the kvno command, my error message changes 

:from 

kvno: KDC returned error string: PROCESS_TGS while getting credentials for hive/xyz@xyz

:to

kvno: Decrypt integrity check failed while getting credentials for hive/xyz@xyz

full kvno cmmand trace is as below:

# kvno hive/xyz@xyz
[128763] 1559917554.849763: Getting credentials HTTP/xxx.abc.com@ABC.COM -> hive/xyz@xyz using ccache FILE:/tmp/krb5cc_0
[128763] 1559917554.849764: Retrieving HTTP/xxx.abc.com@ABC.COM -> hive/xyz@xyz from FILE:/tmp/krb5cc_0 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_0)
[128763] 1559917554.849765: Retrieving HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@xyz from FILE:/tmp/krb5cc_0 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_0)
[128763] 1559917554.849766: Retrieving HTTP/xxx.abc.com@ABC.COM -> krbtgt/ABC.COM@ABC.COM from FILE:/tmp/krb5cc_0 with result: 0/Success
[128763] 1559917554.849767: Starting with TGT for client realm: HTTP/xxx.abc.com@ABC.COM -> krbtgt/ABC.COM@ABC.COM
[128763] 1559917554.849768: Retrieving HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@xyz from FILE:/tmp/krb5cc_0 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_0)
[128763] 1559917554.849769: Requesting TGT krbtgt/xyz@ABC.COM using TGT krbtgt/ABC.COM@ABC.COM
[128763] 1559917554.849770: Generated subkey for TGS request: aes256-cts/4F0F
[128763] 1559917554.849771: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[128763] 1559917554.849773: Encoding request body and padata into FAST request
[128763] 1559917554.849774: Sending request (1022 bytes) to ABC.COM
[128763] 1559917554.849775: Sending initial UDP request to dgram 10.68.5.219:88
[128763] 1559917554.849776: Received answer (969 bytes) from dgram 10.68.5.219:88
[128763] 1559917554.849777: Response was from master KDC
[128763] 1559917554.849778: Decoding FAST response
[128763] 1559917554.849779: FAST reply key: aes256-cts/944C
[128763] 1559917554.849780: TGS reply is for HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@ABC.COM with session key aes256-cts/B3D3
[128763] 1559917554.849781: TGS request result: 0/Success
[128763] 1559917554.849782: Storing HTTP/xxx.abc.com@ABC.COM -> krbtgt/xyz@ABC.COM in FILE:/tmp/krb5cc_0
[128763] 1559917554.849783: Received TGT for service realm: krbtgt/xyz@ABC.COM
[128763] 1559917554.849784: Requesting tickets for hive/xyz@xyz, referrals on
[128763] 1559917554.849785: Generated subkey for TGS request: aes256-cts/DF91
[128763] 1559917554.849786: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[128763] 1559917554.849788: Encoding request body and padata into FAST request
[128763] 1559917554.849789: Sending request (1013 bytes) to xyz
[128763] 1559917554.849790: Resolving hostname xyz
[128763] 1559917554.849791: Sending initial UDP request to dgram 10.68.166.7:88
[128763] 1559917554.849792: Received answer (138 bytes) from dgram 10.68.166.7:88
[128763] 1559917554.849793: Response was not from master KDC
[128763] 1559917554.849794: TGS request result: -1765328353/Decrypt integrity check failed
[128763] 1559917554.849795: Requesting tickets for hive/xyz@xyz, referrals off
[128763] 1559917554.849796: Generated subkey for TGS request: aes256-cts/34D1
[128763] 1559917554.849797: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4
[128763] 1559917554.849799: Encoding request body and padata into FAST request
[128763] 1559917554.849800: Sending request (1013 bytes) to xyz
[128763] 1559917554.849801: Resolving hostname xyz
[128763] 1559917554.849802: Sending initial UDP request to dgram 10.68.166.7:88
[128763] 1559917554.849803: Received answer (138 bytes) from dgram 10.68.166.7:88

[128763] 1559917554.849805: TGS request result: -1765328353/Decrypt integrity check failed
kvno: Decrypt integrity check failed while getting credentials for hive/xyz@xyz

最佳答案

问题出在AD上，而Hadoop Trust无法正常工作。因此，在故障排除期间，我在AD的Hadoop Principal上添加了enctypes。我在其中一个网站上发现了以下说明

“主体(帐户)是使用系统默认的enctype创建的。更改密码类型时，还必须重新创建主体，或至少更新主体的密码。”

所以，我做了密码重置

netdom trust xyz /Domain:ABC.COM / reset / realm / passwordt:xxxxXXXxxxx

而且，KVNO在AD和Hadoop之间没有多余的匹配，所以我在Hadoop端更新了kvno

在Hadoop服务器上重新启动了以下服务

/ sbin / service krb5kdc重新启动
/ sbin / service kadmin重新启动

和Voila ...我能够运行kvno命令。

kinit -k -t xxx.host.keytab HTTP/xxx.abc.com@ABC.COM

[74264] 1561019777.500742:在文件中存储HTTP/xxx.abc.com@ABC.COM-> krbtgt/ABC.COM@ABC.COM:/ tmp / krb5cc_1001

klist -eaf

票证缓存:FILE:/ tmp / krb5cc_1001
默认主体:HTTP/xxx.abc.com@ABC.COM

有效的启动过期服务主体
06/20/2019 14:06:17 06/21/2019 00:06:17 krbtgt/ABC.COM@ABC.COM
续展至06/27/2019 14:06:17，标志:FRI
Etype(key，tkt):aes256-cts-hmac-sha1-96，aes256-cts-hmac-sha1-96
地址:(无)

kvno hive / xyz @ xyz

[74362] 1561019789.592571:获得了所需服务 hive 的信用:hive / xyz @ xyz
[74362] 1561019789.592572:在文件中存储HTTP/xxx.abc.com@ABC.COM-> hive / xyz @ xyz:/ tmp / krb5cc_1001
hive / xyz @ xyz:kvno = 1

关于hadoop - Active Directory-Hortonworks跨领域信任建立，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/56504729/

文章推荐： unix - 我们可以使用EXPORT命令将hadoop数据复制到AWS S3吗？

文章推荐： sql - Apache Impala的迭代函数

文章推荐： php - 修改数据卷中的文件后添加了非法 token

excel - 建立 Excel 公式的间接函数
我正在尝试使用 Excel 中的间接函数来构建公式以在另一张纸上返回值。在工作表 A 单元格 D3 的值为 B 我想使用值 B 从名为 App Summary 的工作表中的单元格 B6 返回一个值。
c# - 建立 SIP 连接后如何流式传输音频
我目前正在使用 LumiSoft 的 SIP 堆栈，并且能够在我的 FreePBX 盒子上成功注册分机并调用另一个软电话。我现在需要做的就是通过调用流式传输 WAV 文件(或 RAW，或任何可行的文件
java - 建立 URL 连接会使我的应用程序崩溃
这个问题已经有答案了: How can I fix 'android.os.NetworkOnMainThreadException'? (65 个回答) 已关闭 8 年前。我有一个安卓 Activ
javascript - 建立 websocket 连接时出错
我正在使用 ws npm 在服务器端，websocket 在客户端。从 node-js 运行此代码时它工作正常，但从浏览器运行它会出现以下错误: failed: Error in connectio
jquery - 阻止 fadeToggle() 建立
当我将鼠标悬停在想要淡入和淡出的内容上多次时，它就会不断重复。即使我停止悬停它。我怎样才能阻止这个？ $(".featured").hover(function(){ $(this).find
android 建立 mysql 连接并获取一些数据
我需要建立一个 mysql 连接并取回一些数据。我可以使用此代码在 Java 中执行此操作 try{ String username;
c++ - 建立 facebook 愚蠢
不能制造愚蠢。具有下一个文件夹结构: /flint/double-conversion/src /燧石/愚蠢/愚蠢/ 其中/flint/folly 包含自述文件和许可证。作为in the readme
c# - 建立。在构建之前创建 EmbeddedResource
我想在编译主单元之前在程序集中嵌入本地引用。但书面目标不起作用。 WithMetadataValue( 'CopyLocal', 'true' )->Met
c - 建立 TCP 套接字连接时出现问题
我不是软件专家，但我确实需要一些建议。我正在编写一个 C 程序(在下面剪切/粘贴)以通过 LAN(以太网)建立从我的 Mac Pro 到位于它旁边的基于 Windows XP 的测试仪器的 TCP
tcp - 建立 TCP 连接需要多少数据？
我正在构建一个应用程序，我的手机经常将数据发送到我的服务器。由于我将使用我的移动数据，我想知道建立(和拆除？)到我的服务器的 TCP 连接需要多少数据。最佳答案 TCP 三向握手 Device 1
php - 使用具有持久连接的先前 PDO 建立
我有一个带有登录表单的网站。当加载登录表单页面时，我创建一个新的 PDO 对象以查看连接是否正常工作。如果成功打开连接，查看者将看到一个登录表单。如果不成功，他们会收到一条消息，说明服务器已关闭。然
electron - 建立 Electron 应用程式后，产品名称未定义
构建我的Electron应用程序后，它将显示产品名称undefined。如何设置其他名称呢？当前是这样的: 最佳答案请尝试此操作。引用此链接 https://www.electronjs.org/
grails - 建立 war 后使用不同版本的两种mail.jar
我有一个项目在哪里使用这个 jar 。据我所知...发生 war 之后，文件夹WEB-INF/lib必须具有: mail-1.4.1.jar activation-1.1.jar mysql-con
c - 建立 Bison 语法时，终端上显示了太多无用的规则
代码： %{ #include #include #include #include "gener.h" #include "sym_tab.h" #include "scope.h" #inc
mysql - 从外部主机获取动态数据 - 建立 mysql 连接或通过curl获取数据？
我需要将侧边栏小部件集成到我的高流量页面(称为SiteA)中。该小部件应包含我的其他页面之一(称为 SiteB)的最新文章。在我看来，我有两种可能的解决方案。 SiteA 上的 cUrl 调用从 S
node.js - 建立 Cortana 拍照技能
我正在尝试建立 Cortana 技能，以便能够使用 Surface 相机拍照。怎么做？目前我的技能是能够使用bot框架和使用nodejs来回答问题。代码看起来像 bot.dialog('ScanCar
java - 建立 SSL 主机连接时无法使用签名证书验证 Cacerts
这个问题在这里已经有了答案: Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorExce
android - 建立 https 连接的 SSLProtocolException
当我与网络服务器建立 https 连接时出现 SSLProtocolException。我只在 Android 2.3 Gingebread 中有这个异常(exception)；相同的代码在所有其他
tcp - 检查 TCP 端口是否连接/建立？
我想做的是指定几个端口，然后检查它们是否已建立连接。我找到了以下脚本并运行了，但它只列出了 3 个端口，我不明白为什么。我验证了相关端口的事件规则(以及下面输出中未列出的许多其他端口)。 Set ob
mysql - 建立 N-M 关系的问题
使用 MySQL 我试图使用已经上传到数据库中的数据建立一对多关系。举个例子，假设我在一个表中有一个名字列表，我想将它们连接到一个他们去过的地方的列表。显然 1 个人可以去很多不同的地方，但我在设置时

行者123

个人简介

我是一名优秀的程序员,十分优秀！

作者热门文章

滴滴打车优惠券免费领取

全站热门文章

首页

博学

6Ren·AI

商城

hadoop - Active Directory-Hortonworks跨领域信任建立