[
https://issues.apache.org/jira/browse/KYLIN-1014?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14733819#comment-14733819
]
Yerui Sun commented on KYLIN-1014:
----------------------------------
Actually, we're using Kerberos for hadoop and hbase authentication and met same
issue too.
More strictly, we've found the authentication exception occurred not only when
request RM via http, but also when setup RPC connection to MR or HBase, such as
submit a job or create table in hbase.
The reason was, in our analysis, that there's no login related code in kylin,
and use kerberos ticket cache for authentication by default. When ticket was
expired, kylin can't renew the ticket and can't setup connection to MR or HBase
again.
Our solution by now is exporting KRB5CCNAME to env and executing 'kinit' in
shell before start kylin, and renew the ticket named $\{KRB5CCNAME\}
periodically by crontab. Kylin will use this ticket which always valid and
never met authentication exception again.
I'm not sure your patch could resolve the authentication issue completely.
Maybe we need more discussions on this.
> patch for supporting kerberos authentication while getting status from RM
> -------------------------------------------------------------------------
>
> Key: KYLIN-1014
> URL: https://issues.apache.org/jira/browse/KYLIN-1014
> Project: Kylin
> Issue Type: Bug
> Reporter: fengYu
> Attachments: 0001-kerberos.patch
>
>
> I have used kylin-0.7.2 build cube and do some query, and I am trying
> kylin-1.0 in another hadoop cluster. I get this problem below in kylin-0.7.2
> and kylin-1.0 :
> Our hadoop cluster deals with authentication with kerberos, However, We find
> after submit a mapreduce job(the second step in building cube), kylin will
> send a http request to RM server and get the job status at regular intervals,
> But we always get errors here because kylin do nothing about kerberos.
> Finally , we do some change on source code and make it support kerberos
> authentication . attachment is my patch file..
> I add a property named "kylin.job.status.with.kerberos" which means if we
> need do authentication with kerberos when getting status from RM, the default
> value is false.
> It will be highly appreciated if you have some good idea or some suggestion.
> Thanks...
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
