Jyotirmoy Sinha created HDDS-10950:
--------------------------------------
Summary: Ticket expired while renewing credentials in kerberos-ad
upgrade cluster
Key: HDDS-10950
URL: https://issues.apache.org/jira/browse/HDDS-10950
Project: Apache Ozone
Issue Type: Bug
Reporter: Jyotirmoy Sinha
Ticket expired while renewing credentials in kerberos-ad upgrade cluster
Console error output while running container info command -
{code:java}
> "Container Info for id=[%s] failed: %s" % (container_id, output)
E AssertionError: Container Info for id=[15034] failed: Exception
encountered while running the renewal command for
[email protected]. (TGT end time:1698666389000, renewalFailures: 0,
renewalFailuresTotal: 1)
E ExitCodeException exitCode=1: kinit: Ticket expired while renewing
credentials
E
E at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
E at java.util.concurrent.FutureTask.run(FutureTask.java:266)
E at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
E at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
E at java.lang.Thread.run(Thread.java:750)
E TGT is expired. Aborting renew thread for [email protected].
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Couldn't setup connection for [email protected] to
quasar-wzvoxf-7.quasar-wzvoxf.root.hwx.site/172.27.25.210:9860
E javax.security.sasl.SaslException: GSS initiate failed [Caused by
GSSException: No valid credentials provided (Mechanism level: Ticket expired
(32))]
E at
com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
E at com.sun.proxy.$Proxy17.submitRequest(Unknown Source)
E at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
E at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
E at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
E at java.lang.reflect.Method.invoke(Method.java:498)
E at com.sun.proxy.$Proxy17.submitRequest(Unknown Source)
E at picocli.CommandLine.executeUserObject(CommandLine.java:1953)
E at picocli.CommandLine.access$1300(CommandLine.java:145)
E at
picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2352)
E at picocli.CommandLine$RunLast.handle(CommandLine.java:2346)
E at picocli.CommandLine$RunLast.handle(CommandLine.java:2311)
E at
picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2179)
E at picocli.CommandLine.execute(CommandLine.java:2078)
E Caused by: GSSException: No valid credentials provided (Mechanism
level: Ticket expired (32))
E at
sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:772)
E at
sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
E at
sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
E at
com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192)
E ... 47 more
E Caused by: KrbException: Ticket expired (32)
E at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:70)
E at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:226)
E at
sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:237)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCredsSingle(CredentialsUtil.java:477)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:340)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:314)
E at
sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:169)
E at
sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:490)
E at
sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:695)
E ... 50 more
E Caused by: KrbException: Identifier doesn't match expected value (906)
E at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
E at sun.security.krb5.internal.TGSRep.init(TGSRep.java:65)
E at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:60)
E at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
E ... 58 more
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Couldn't setup connection for [email protected] to
quasar-wzvoxf-8.quasar-wzvoxf.root.hwx.site/172.27.22.73:9860
E javax.security.sasl.SaslException: GSS initiate failed [Caused by
GSSException: No valid credentials provided (Mechanism level: Ticket expired
(32))]
E at
com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
E at com.sun.proxy.$Proxy17.submitRequest(Unknown Source)
E at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
E at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
E at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
E at java.lang.reflect.Method.invoke(Method.java:498)
E at com.sun.proxy.$Proxy17.submitRequest(Unknown Source)
E at picocli.CommandLine.executeUserObject(CommandLine.java:1953)
E at picocli.CommandLine.access$1300(CommandLine.java:145)
E at
picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2352)
E at picocli.CommandLine$RunLast.handle(CommandLine.java:2346)
E at picocli.CommandLine$RunLast.handle(CommandLine.java:2311)
E at
picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2179)
E at picocli.CommandLine.execute(CommandLine.java:2078)
E Caused by: GSSException: No valid credentials provided (Mechanism
level: Ticket expired (32))
E at
sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:772)
E at
sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
E at
sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
E at
com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192)
E ... 47 more
E Caused by: KrbException: Ticket expired (32)
E at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:70)
E at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:226)
E at
sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:237)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCredsSingle(CredentialsUtil.java:477)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:340)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:314)
E at
sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:169)
E at
sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:490)
E at
sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:695)
E ... 50 more
E Caused by: KrbException: Identifier doesn't match expected value (906)
E at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
E at sun.security.krb5.internal.TGSRep.init(TGSRep.java:65)
E at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:60)
E at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
E ... 58 more
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Not attempting to re-login since the last re-login was attempted less
than 60 seconds before. Last Login=1698666343150
E Couldn't setup connection for [email protected] to
quasar-wzvoxf-9.quasar-wzvoxf.root.hwx.site/172.27.137.130:9860
E javax.security.sasl.SaslException: GSS initiate failed [Caused by
GSSException: No valid credentials provided (Mechanism level: Ticket expired
(32))]
E at
com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
E at com.sun.proxy.$Proxy17.submitRequest(Unknown Source)
E at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
E at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
E at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
E at java.lang.reflect.Method.invoke(Method.java:498)
E at com.sun.proxy.$Proxy17.submitRequest(Unknown Source)
E at picocli.CommandLine.executeUserObject(CommandLine.java:1953)
E at picocli.CommandLine.access$1300(CommandLine.java:145)
E at
picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2352)
E at picocli.CommandLine$RunLast.handle(CommandLine.java:2346)
E at picocli.CommandLine$RunLast.handle(CommandLine.java:2311)
E at
picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2179)
E at picocli.CommandLine.execute(CommandLine.java:2078)
E Caused by: GSSException: No valid credentials provided (Mechanism
level: Ticket expired (32))
E at
sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:772)
E at
sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
E at
sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
E at
com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192)
E ... 47 more
E Caused by: KrbException: Ticket expired (32)
E at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:70)
E at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:226)
E at
sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:237)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCredsSingle(CredentialsUtil.java:477)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:340)
E at
sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:314)
E at
sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:169)
E at
sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:490)
E at
sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:695)
E ... 50 more
E Caused by: KrbException: Identifier doesn't match expected value (906)
E at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
E at sun.security.krb5.internal.TGSRep.init(TGSRep.java:65)
E at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:60)
E at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
E ... 58 more {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
