码迷,mamicode.com
首页 > 编程语言 > 详细

java远程连接hadoop,kerbers认证失败 报no supported default etypes for default_tkt_enctypes

时间:2019-11-20 16:58:19      阅读:277      评论:0      收藏:0      [点我收藏+]

标签:detail   gif   jce   creat   directory   udp   new   null   main   

 

@PostConstruct
    public void init() throws Exception {
        if (conn == null) {
//            System.setProperty("hadoop.home.dir", "G:/keyberos/hbase");
            System.setProperty("java.security.krb5.conf",krbConf);
            conf = HBaseConfiguration.create();
            conf.set("hbase.zookeeper.property.clientPort", zkPort); 
            conf.set("hbase.zookeeper.quorum", zkHost);
            conf.set("hbase.master", master);
//            conf.addResource(hbaseSite);
            conf.set("hadoop.security.authentication", "kerberos");
            conf.set("hbase.security.authentication", "kerberos");
            conf.set("hbase.cluster.distributed", "true");
            conf.set("hbase.rpc.protection", "authentication"); 
            conf.set("hbase.master.kerberos.principal", principal); // this is needed even if you connect over rpc/zookeeper
            conf.set("hbase.regionserver.kerberos.principal", principal); //what principal the master/region. servers use.
            
            String principal = System.getProperty("kerberosPrincipal", kerberosPrincipal);
            String keytabLocation = System.getProperty("kerberosKeytab",keyberos);
            
            UserGroupInformation.setConfiguration(conf);
            UserGroupInformation.loginUserFromKeytab(principal, keytabLocation);
            
            conn = ConnectionFactory.createConnection(conf);
        }
    }

在 UserGroupInformation.loginUserFromKeytab(principal, keytabLocation) 处报错:

java.io.IOException: Login failure for hbase@XXXX.COM from keytab F:/hbase/hbase.keytab: javax.security.auth.login.LoginException: no supported default etypes for default_tkt_enctypes

参数分别为 hbase@XXXX.COM,F:/hbase/hbase.keytab 。

java.security.krb5.conf设置为F:/hbase/krb5.conf :
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = XXXX.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 default_tgs_enctypes = aes256-cts-hmac-sha1-96
 default_tkt_enctypes = aes256-cts-hmac-sha1-96
 permitted_enctypes = aes256-cts-hmac-sha1-96
 clockskew = 120
 udp_preference_limit = 1

[realms]
XXXX.COM = {
  kdc = bdp01
  admin_server = bdp01
 }

[domain_realm]
 .xxxx.com = XXXX.COM
xxxx.com = XXXX.COM

处理:下载jdk8对应的JCE文件添加到jdk/jre/lib/security下

技术图片技术图片

 

 初步推测是,jdk需要相应的加密解密方式来处理hbase.keytab 文件。

参考https://blog.csdn.net/wulantian/article/details/42173095

技术图片

 

 

 

 

 

 

 

 

 

java远程连接hadoop,kerbers认证失败 报no supported default etypes for default_tkt_enctypes

标签:detail   gif   jce   creat   directory   udp   new   null   main   

原文地址:https://www.cnblogs.com/mryangbo/p/11898648.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!