I'm not an expert but I believe this indicates an environmental issue, see "service ticket not found in the subject" here: https://steveloughran.gitbooks.io/kerberos_and_hadoop/content/sections/errors.html
Patrick On Tue, Aug 16, 2016 at 12:11 PM, Irfan Hamid <iha...@salesforce.com> wrote: > Hi, > > I'm very certain this is due to an error in my jaas or krb5 conf files but > I can't seem to figure out where. My jaas.conf looks something like this: > > Client { > com.sun.security.auth.module.Krb5LoginModule required > useKeyTab=true > keyTab="/etc/zkcli_app_eng.keytab" > storeKey=true > useTicketCache=false > debug=true > principal="zk...@ay.bee.see.net"; > }; > > But when ZK starts up it sends a TGT request as krbtgt/ > bee.see....@ay.bee.see.net, i.e., it shaves off the AY from the realm > name ( > BEE.SEE.NET is a valid realm in our setup but not the one I want to use). > I > see the following log lines: > msgType is 30 > sname is krbtgt/BEE.SEE.NET > realm is AY.BEE.SEE.NET > cname is zkcli > crealm is AY.BEE.SEE.NET > error Message is Server not found in Kerberos database > error code is 7 > suSec is 157006 > sTime is Tue Aug 16 19:00:48 GMT 2016 1471374048000 > cTime is Fri Sep 30 18:19:26 GMT 2016 1475259566000 > > > And a little earlier there was: > Credentials acquireServiceCreds: main loop: [0] tempService=krbtgt/ > bee.see....@ay.bee.see.net > Realm parseCapaths: no cfg entry > Realm doInitialParse: cRealm=[AY.BEE.SEE.NET], sRealm=[BEE.SEE.NET] > Service ticket not found in the subject > Found ticket for zk...@ay.bee.see.net to go to krbtgt/ > ay.bee.see....@ay.bee.see.net expiring on Tue Aug 16 21:00:06 GMT 2016 > > I looked in the source code and the place I see that might be relevant is > Login.java where we have Login.getTGT() which tries to obtain a TGT by > seeing if there's a ticket in the Subject of the form krbtgt/REALM@REALM. > However, that part doesn't even get called since I don't even see the log > line at the of the Login thread "TGT refresh thread started". > > Any help would be much appreciated. > > Thanks, > Irfan. >