Re: renew ticket failed

2023-11-09 Thread Greg Hudson 

On 11/8/23 16:13, Dong Ye wrote:

   we encountered an issue where we can't renew the ticket before the
ticket expires. Seems the ticket is renewable but its renew_till time is
before its end_time. How is it possible?


It's possible if the ticket was requested that way ("kinit -l 2h -r 1h" 
for instance).  For a period of time (1.12 through 1.15) the MIT krb5 
KDC issued non-renewable tickets for such requests, but that was found 
to be disruptive to scripts, so it once again issues renewable tickets 
whose end times can't be extended.


Kerberos mailing list   Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

renew ticket failed

2023-11-08 Thread Dong Ye 
Hi, All:


  we encountered an issue where we can't renew the ticket before the
ticket expires. Seems the ticket is renewable but its renew_till time is
before its end_time. How is it possible? How to fix that. The relevant logs
are :


WARN  | 27 Sep 2023 12:59:52,009 |
> org.apache.hadoop.security.UserGroupInformation | Exception encountered
> while running the renewal command for
> hive/ip-10-54-57-56.us-west-2.compute.internal@us-west-2.compute.internal.
> (TGT end time:1695825352000, renewalFailures:
> org.apache.hadoop.metrics2.lib.MutableGaugeInt@298f6c8,renewalFailuresTotal:
> org.apache.hadoop.metrics2.lib.MutableGaugeLong@1093bbfd)
> org.apache.hadoop.util.Shell$ExitCodeException: kinit: Ticket expired
> while renewing credentials
>
> at org.apache.hadoop.util.Shell.runCommand(Shell.java:998)
> ~[hadoop-common-2.10.1-amzn-4.jar:?]
> at org.apache.hadoop.util.Shell.run(Shell.java:884)
> ~[hadoop-common-2.10.1-amzn-4.jar:?]
> at
> org.apache.hadoop.util.Shell$ShellCommandExecutor.execute(Shell.java:1216)
> ~[hadoop-common-2.10.1-amzn-4.jar:?]
> at org.apache.hadoop.util.Shell.execCommand(Shell.java:1310)
> ~[hadoop-common-2.10.1-amzn-4.jar:?]
> at org.apache.hadoop.util.Shell.execCommand(Shell.java:1292)
> ~[hadoop-common-2.10.1-amzn-4.jar:?]
> at
> org.apache.hadoop.security.UserGroupInformation$1.run(UserGroupInformation.java:1003)
> [hadoop-common-2.10.1-amzn-4.jar:?]
> at java.lang.Thread.run(Thread.java:750) [?:1.8.0_382]


Note the TGT end time 1695825352000 is 27 September 2023 14:35:52 which is
in the future of the logging time 27 Sep 2023 12:59:52,009.

Thanks.

Have a nice day.

Kerberos mailing list   Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos