Question

我hava hadoop-2.7群集，oozie-4.0.1以安全模式运行（使用kerberos）。一切都很好。我可以使用cli命令提交作业如下：

Kinit myuser
oozie job -oozie https://10.1.130.10:21003/oozie -config job.properties -run

但我使用oozie java api提交作业，发生kerberos异常。

线程“main”中的异常AUTHENTICATION：无法进行身份验证，GSSException：未提供有效凭据（机制级别：无法找到任何Kerberos tgt）在org.apache.oozie.client.AuthOozieClient.createConnection（AuthOozieClient.java:150）在org.apache.oozie.client.OozieClient.getSupportedProtocolVersions（OozieClient.java:577）在org.apache.oozie.client.OozieClient.validateWSVersion（OozieClient.java:538）在org.apache.oozie.client.OozieClient.createURL（OozieClient.java:651）在org.apache.oozie.client.OozieClient.access $ 100（OozieClient.java:103）在org.apache.oozie.client.OozieClient $ ClientCallable.call（OozieClient.java:803）在org.apache.oozie.client.OozieClient.run（OozieClient.java:999）在com.huawei.oozie.OozieMain.main（OozieMain.java:47）

由以下原因引起： org.apache.hadoop.security.authentication.client.AuthenticationException：GSSException：未提供有效凭据（机制级别：无法找到任何Kerberos tgt）在org.apache.hadoop.security.authentication.client.KerberosAuthenticator.doSpnegoSequence（KerberosAuthenticator.java:334）在org.apache.hadoop.security.authentication.client.KerberosAuthenticator.authenticate（KerberosAuthenticator.java:206）在org.apache.hadoop.security.authentication.client.AuthenticatedURL.openConnection（AuthenticatedURL.java:215）在org.apache.oozie.client.AuthOozieClient.createConnection（AuthOozieClient.java:144） ......还有7个

由引起：GSSException：未提供有效凭据（机制级别：无法找到任何Kerberos tgt） at sun.security.jgss.krb5.Krb5InitCredential.getInstance（Krb5InitCredential.java:147） at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement（Krb5MechFactory.java:122） at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext（Krb5MechFactory.java:187） at sun.security.jgss.GSSManagerImpl.getMechanismContext（GSSManagerImpl.java:224） at sun.security.jgss.GSSContextImpl.initSecContext（GSSContextImpl.java:212） at sun.security.jgss.GSSContextImpl.initSecContext（GSSContextImpl.java:179） at org.apache.hadoop.security.authentication.client.KerberosAuthenticator $ 1.run（KerberosAuthenticator.java:313）在org.apache.hadoop.security.authentication.client.KerberosAuthenticator $ 1.run（KerberosAuthenticator.java:288） at java.security.AccessController.doPrivileged（Native Method）在javax.security.auth.Subject.doAs（Subject.java:422）在org.apache.hadoop.security.authentication.client.KerberosAuthenticator.doSpnegoSequence（KerberosAuthenticator.java:288） ......还有10个

我的java代码如下：

System.setProperty("java.security.auth.login.config", System.getProperty("user.dir") + File.separator + "conf"
            + File.separator + "jaas.conf ");
    System.setProperty("java.security.krb5.conf", System.getProperty("user.dir") + File.separator + "conf"
            + File.separator + "krb5.conf ");

    String url = "https://10.137.60.60:21003/oozie";
    AuthOozieClient wc = new AuthOozieClient(url);

    wc.setDebugMode(1);

    Properties conf = wc.createConfiguration();
    FileReader fr = new FileReader("conf/job.properties");
    conf.load(fr);

    System.out.println(conf.toString());
    String jobId = wc.run(conf);
    System.out.println("Workflow job submitted");

    while (wc.getJobInfo(jobId).getStatus() == WorkflowJob.Status.RUNNING)
    {
        System.out.println("Workflow job running ...");
        Thread.sleep(3 * 1000);
    }

    System.out.println("Workflow job completed ...");
    System.out.println(wc.getJobInfo(jobId));

我的conf / jaas.conf如下：

Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="D:/workspace/4.4-billing/Oozie/conf/oozie.keytab"
principal="oozie@HADOOP.COM"
useTicketCache=false
storeKey=true
debug=true;
};

谁能帮助我吗？我知道oozie使用hadoop-auth jar。但如何设置keytab，编写验证码，我不能。

Answer 1

将您的kerberos用户帐户设置为

conf.setProperty(OozieClient.USER_NAME, "xyz");
oozieClient.run(conf);

oozie java api submit job，kerberos身份验证错误

1 个答案: