All Apps and Add-ons
Highlighted

Splunk Analytics for Hadoop: kerberos authentication failed

Contributor

Hi all

I have splunkd1@TS.fitco.com user on the splunk node and splunkd1@RT.rtp.com user on hadoop cluster.

I have created keytabfile for splunkd1@TS.fitco.com and provided in the indexes.conf....and I get this error while executing hadoop commands on splunk host.

ls: Failed on local exception: java.io.IOException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]; Host Details : local host is: "splunkdev@TS.fitco.com/xx.xx.xx.xxx"; destination host is: "SLPP02.HADOOP.company.COM:8020;

[hadoopidx]
coldPath = $SPLUNKDB/hadoopidx/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK
DB/hadoopidx/db
maxTotalDataSizeMB = 20480
thawedPath = $SPLUNK_DB/hadoopidx/thaweddb

[provider:eihadoop]
vix.command.arg.3 = $SPLUNKHOME/bin/jars/SplunkMR-hy2.jar
vix.dfs.namenode.kerberos.principal = hdfs/
HOST@HADOOP.company.COM
vix.env.HADOOPHOME = /opt/local/hadoop-2.6.0-cdh5.9.1
vix.env.HUNK
THIRDPARTYJARS = $SPLUNKHOME/bin/jars/thirdparty/common/avro-1.7.7.jar,$SPLUNKHOME/bin/jars/thirdparty/common/avro-mapred-1.7.7.jar,$SPLUNKHOME/bin/jars/thirdparty/common/commons-compress-1.10.jar,$SPLUNKHOME/bin/jars/thirdparty/common/commons-io-2.4.jar,$SPLUNKHOME/bin/jars/thirdparty/common/libfb303-0.9.2.jar,$SPLUNKHOME/bin/jars/thirdparty/common/parquet-hive-bundle-1.6.0.jar,$SPLUNKHOME/bin/jars/thirdparty/common/snappy-java-1.1.1.7.jar,$SPLUNKHOME/bin/jars/thirdparty/hive12/hive-exec-1.2.1.jar,$SPLUNKHOME/bin/jars/thirdparty/hive12/hive-metastore-1.2.1.jar,$SPLUNKHOME/bin/jars/thirdparty/hive12/hive-serde-1.2.1.jar
vix.env.JAVA
HOME = /usr/java/jdk1.8.0102
vix.family = hadoop
vix.fs.default.name = hdfs://SLPP02.HADOOP.company.COM:8020
vix.hadoop.security.authentication = kerberos
vix.hadoop.security.authorization = 1
vix.javaprops.java.security.krb5.kdc = SLP013.HADOOP.company.COM
vix.javaprops.java.security.krb5.realm = HADOOP.company.COM
vix.mapreduce.framework.name = yarn
vix.output.buckets.max.network.bandwidth = 0
vix.splunk.home.hdfs = /user/splunkdev/hadoopanalytics/
vix.yarn.nodemanager.principal = yarn/
HOST@HADOOP.company.COM
vix.yarn.resourcemanager.address = https://SLPP08.HADOOP.company.COM:8090/cluster
vix.yarn.resourcemanager.principal = yarn/HOST@HADOOP.company.COM
vix.yarn.resourcemanager.scheduler.address = https://SLPP015.HADOOP.company.COM:8090/cluster/scheduler
vix.mapreduce.jobtracker.kerberos.principal = mapred/
HOST@HADOOP.company.COM
vix.kerberos.keytab = /home/splunkd1/splunkd1.keytab
vix.kerberos.principal = splunkdev@TS.company2.COM

[splunkindexarchive]
vix.output.buckets.from.indexes = hadoopidx
vix.output.buckets.older.than = 172800
vix.output.buckets.path = /user/splunkdev/splunkindexarchive
vix.provider = eihadoop

0 Karma
Highlighted

Re: Splunk Analytics for Hadoop: kerberos authentication failed

Splunk Employee
Splunk Employee

This link may help you debug the message ' Failed to find any Kerberos tgt '
https://www.cloudera.com/documentation/enterprise/5-8-x/topics/cm_sg_verify_kerb_security_s18.html

0 Karma
Highlighted

Re: Splunk Analytics for Hadoop: kerberos authentication failed

Contributor

Hi @rdagan,

When I run any job on the Hadoop server it works fine without any issues.

However it fails on the splunk Analytics for Hadoop Server.

I'm quite confused with the kerberos settings in indexes.conf for which I might need some help here:

I have splunkd1@TS.fitco.com Principal on the splunk analytics node and splunkd1@RT.rtp.com principal on hadoop cluster. Both these two different accounts with diff passwords.

I was able to run a mapreduce job on the Hadoop cluster using splunkd1@RT.rtp.com user account.

I generated keytab file (splunkd1.keytab) for splunkd1@RT.rtp.com on the Splunk node - at /home/splunkd1/ and updated indexes.conf with the same as below:

vix.kerberos.keytab = /home/splunkd1/splunkd1.keytab
vix.kerberos.principal = splunkd1@RT.rtp.com

Are the steps that I've followed incorrect or correct??
Kindly help.

0 Karma