[ https://issues.apache.org/jira/browse/HADOOP-14708?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16114841#comment-16114841 ]
Wei-Chiu Chuang edited comment on HADOOP-14708 at 8/4/17 7:06 PM: ------------------------------------------------------------------ [~cltlfcjin] thanks for reporting the issue. However, I don't have the problem you described. The fsck command line tool as a client does not have problem authenticating with NN on my cluster. Furthermore, the log you posted suggests the problem is the authentication between the NameNode FsckServlet (which starts a dfsclient to connect to NN) and NameNode. If there's a bug, it is strictly a HDFS RPC authentication bug, nothing to do with JspHelper. Because it's a HDFS RPC, it should have not used KERBEROS_SSL at all. Can you check if you have the correct client authentication configuration in the NameNode configuration? was (Author: jojochuang): [~cltlfcjin] thanks for reporting the issue. However, I don't have the problem you described. The fsck command line tool as a client does not have problem authenticating with NN on my cluster. Furthermore, the log you posted suggests the problem is the authentication between the NameNode FsckServlet (which starts a dfsclient to connect to NN) and NameNode. If there's a bug, it is strictly a HDFS RPC authentication bug, nothing to do with JspHelper. Because it's a HDFS RPC, it should have not used KERBEROS_SSL at all. > FsckServlet can not create SaslRpcClient with auth KERBEROS_SSL > --------------------------------------------------------------- > > Key: HADOOP-14708 > URL: https://issues.apache.org/jira/browse/HADOOP-14708 > Project: Hadoop Common > Issue Type: Bug > Components: security > Affects Versions: 2.7.3, 2.8.1, 3.0.0-alpha3 > Reporter: Lantao Jin > Attachments: FSCK.log, HADOOP-14708.001.patch > > > FSCK started by xx (auth:KERBEROS_SSL) failed with exception msg "fsck > encountered internal errors!" > FSCK use FSCKServlet to submit RPC to NameNode, it use {{KERBEROS_SSL}} as > its {{AuthenticationMethod}} in {{JspHelper.java}} > {code} > /** Same as getUGI(context, request, conf, KERBEROS_SSL, true). */ > public static UserGroupInformation getUGI(ServletContext context, > HttpServletRequest request, Configuration conf) throws IOException { > return getUGI(context, request, conf, AuthenticationMethod.KERBEROS_SSL, > true); > } > {code} > But when setup SaslConnection with server, KERBEROS_SSL will failed to create > SaslClient instance. See {{SaslRpcClient.java}} > {code} > private SaslClient createSaslClient(SaslAuth authType) > throws SaslException, IOException { > .... > case KERBEROS: { > if (ugi.getRealAuthenticationMethod().getAuthMethod() != > AuthMethod.KERBEROS) { > return null; // client isn't using kerberos > } > {code} -- This message was sent by Atlassian JIRA (v6.4.14#64029) --------------------------------------------------------------------- To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org