Josh, I know you said you didn't have much time, but just in case you get a moment: do you know why `UserGroupInformation.isLoginKeytabBased()` might be false on the server side? This seems to be the root cause of the problems.
https://github.com/apache/accumulo/blob/b0016c3ca36e15ee4bdde727ea5b6a18597de0ff/core/src/main/java/org/apache/accumulo/core/rpc/ThriftUtil.java#L383 On Thu, Mar 22, 2018 at 4:00 PM Josh Elser <els...@apache.org> wrote: > I don't have the time to look at these right now. There isn't much > special about how Accumulo uses Kerberos either. It's straightforward > use via SASL with Thrift. I haven't looked at it since it was passing > when I wrote it originally. > > On 3/20/18 2:32 PM, Christopher wrote: > > I'm currently looking at the KerberosRenewalIT failures that seem to be > > persisting across branches. From the logs, it looks like the accumulo > > services are trying to do ticket-cache based login renewals, instead of > > keytab-based renewals. This has been a problematic test for me before, > > and as such, I've gotten into the habit of ignoring it, but since I've > > not been able to get it to work on reruns, and it fails nearly 100% of > > the time (if not 100%) for me now, I decided to take a closer look. If > > it is doing ticket-cache based renewals, that could indicate a bug in > > the Kerberos authentication, and that would probably warrant a -1 from > > me... but I will continue to investigate first. > > > > Josh, you know more about the Kerberos stuff than anyone here, so if you > > have time/interest, I wouldn't mind getting your feedback on why this > > test might be failing for me. > > > > On Mon, Mar 19, 2018 at 3:44 PM Christopher <ctubb...@apache.org > > <mailto:ctubb...@apache.org>> wrote: > > > > Accumulo Developers, > > > > Please consider the following candidate for Accumulo 1.7.4. > > > > Git Commit: > > b2a59189108d736729432e81b3d5717000c6b891 > > Branch: > > 1.7.4-rc1 > > > > If this vote passes, a gpg-signed tag will be created using: > > git tag -f -m 'Apache Accumulo 1.7.4' -s rel/1.7.4 \ > > b2a59189108d736729432e81b3d5717000c6b891 > > > > Staging repo: > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1068 > > Source (official release artifact): > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1068/org/apache/accumulo/accumulo/1.7.4/accumulo-1.7.4-src.tar.gz > > Binary: > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1068/org/apache/accumulo/accumulo/1.7.4/accumulo-1.7.4-bin.tar.gz > > (Append ".sha1", ".md5", or ".asc" to download the signature/hash > > for a given artifact.) > > > > All artifacts were built and staged with: > > mvn release:prepare && mvn release:perform > > > > Signing keys are available at > https://www.apache.org/dist/accumulo/KEYS > > (Expected fingerprint: 8CC4F8A2B29C2B040F2B835D6F0CDAE700B6899D) > > > > Release notes (in progress) can be found at: > > https://accumulo.apache.org/release/accumulo-1.7.4/ > > > > Please vote one of: > > [ ] +1 - I have verified and accept... > > [ ] +0 - I have reservations, but not strong enough to vote > against... > > [ ] -1 - Because..., I do not accept... > > ... these artifacts as the 1.7.4 release of Apache Accumulo. > > > > This vote will remain open until at least Thu Mar 22 20:00:00 UTC > 2018 > > (Thu Mar 22 16:00:00 EDT 2018 / Thu Mar 22 13:00:00 PDT 2018). > > Voting continues until the release manager sends an email closing > > the vote. > > > > Thanks! > > > > P.S. Hint: download the whole staging repo with > > wget -erobots=off -r -l inf -np -nH \ > > > https://repository.apache.org/content/repositories/orgapacheaccumulo-1068/ > > # note the trailing slash is needed > > >
