Skip to content

Commit 5d4dca8

Browse files
steveloughransteveloughran
committed
briefly mention JAAS
1 parent a6d9a2a commit 5d4dca8

File tree

3 files changed

+104
-0
lines changed

3 files changed

+104
-0
lines changed

‎sections/errors.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,15 @@ an error about checksums.
9797
1. Java 8 behaves differently from Java 6 and 7 here which can cause problems
9898
[(HADOOP-11628](https://issues.apache.org/jira/browse/HADOOP-11628).
9999

100+
## `GSSException: No valid credentials provided (Mechanism level: Fail to create credential. (63) - No service creds)`
101+
102+
103+
Rarely seen. Switching kerberos to use TCP rather than UDP makes it go away
104+
105+
In `krb5.conf`:
106+
107+
[libdefaults]
108+
udp_preference_limit = 1
100109

101110
## Principal not found
102111

‎sections/jaas.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<!---
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
8+
Unless required by applicable law or agreed to in writing, software
9+
distributed under the License is distributed on an "AS IS" BASIS,
10+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
See the License for the specific language governing permissions and
12+
limitations under the License. See accompanying LICENSE file.
13+
-->
14+
15+
16+
# JAAS
17+
18+
JAAS is a nightmare from the Enterprise Java Bean era, one which surfaces from the depths to pull the unwary under. You can see its heritage whenever you search for documentation; it's generally related to managing the context of callers to EJB operations.
19+
20+
21+
JAAS provides for a standard configuration file format for specifying a *login context*; how code trying to run in a specific context/role should login and authenticate.
22+
23+
As a single jaas.conf file can have multiple contexts, the same file can be used to configure the server and clients of a service, each with different binding information. Different contexts can have different login/auth mechanisms, including Kerberos and LDAP, so that you can even specify different auth mechanisms for different roles.
24+
25+
In Hadoop, the JAAS context is invariably Kerberos when it comes to talking to HDFS, YARN, etc. However, if Zookeeper enters the mix, it may be interacted with differently —and so need a different JAAS context.
26+
27+
Fun facts about JAAS
28+
29+
1. Nobody ever mentions it, but the file takes backslashed-escapes like a Java string.
30+
1. It needs escaped backlash directory separators on Windows, such as: `C:\\security\\krb5.conf`. Get that wrong and your code will fail with what will inevitably be an unintuitive message.
31+
1. Each context must declare the authentication module to use. The kerberos authentication model on IBM JVMs is different from that on Oracle and OpenJDK JVMs. You need to know the target JVM for the context —or create separate contexts for the different JVMs.
32+
33+
Hadoop's UGI class will dynamically create a JAAS context for Hadoop logins, dynamically determining the name of the kerberos module to use. For interacting purely with HDFS and YARN, you may be able to avoid needing to know about or understand JAAS.

‎sections/secrets.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,68 @@ If you want to debug what is happening in SPNEGO, another system property lets y
7979
Set the env variable `HADOOP_JAAS_DEBUG` to true and UGI will set the "debug" flag on any JAAS
8080
files it creates
8181

82+
export HADOOP_JAAS_DEBUG=true
83+
84+
85+
On the next Hadoop command, you'll see a trace like
86+
87+
[UnixLoginModule]: succeeded importing info:
88+
uid = 503
89+
gid = 20
90+
supp gid = 20
91+
supp gid = 501
92+
supp gid = 12
93+
supp gid = 61
94+
supp gid = 79
95+
supp gid = 80
96+
supp gid = 81
97+
supp gid = 98
98+
supp gid = 399
99+
supp gid = 33
100+
supp gid = 100
101+
supp gid = 204
102+
supp gid = 395
103+
supp gid = 398
104+
Debug is true storeKey false useTicketCache true useKeyTab false doNotPrompt true ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
105+
Acquire TGT from Cache
106+
Principal is stevel@COTHAM
107+
[UnixLoginModule]: added UnixPrincipal,
108+
UnixNumericUserPrincipal,
109+
UnixNumericGroupPrincipal(s),
110+
to Subject
111+
Commit Succeeded
112+
113+
[UnixLoginModule]: logged out Subject
114+
[Krb5LoginModule]: Entering logout
115+
[Krb5LoginModule]: logged out Subject
116+
[UnixLoginModule]: succeeded importing info:
117+
uid = 503
118+
gid = 20
119+
supp gid = 20
120+
supp gid = 501
121+
supp gid = 12
122+
supp gid = 61
123+
supp gid = 79
124+
supp gid = 80
125+
supp gid = 81
126+
supp gid = 98
127+
supp gid = 399
128+
supp gid = 33
129+
supp gid = 100
130+
supp gid = 204
131+
supp gid = 395
132+
supp gid = 398
133+
Debug is true storeKey false useTicketCache true useKeyTab false doNotPrompt true ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
134+
Acquire TGT from Cache
135+
Principal is stevel@COTHAM
136+
[UnixLoginModule]: added UnixPrincipal,
137+
UnixNumericUserPrincipal,
138+
UnixNumericGroupPrincipal(s),
139+
to Subject
140+
Commit Succeeded
141+
142+
143+
82144
## KRB5CCNAME
83145

84146
The environment variable [`KRB5CCNAME`](http://web.mit.edu/kerberos/krb5-1.4/krb5-1.4/doc/klist.html)

0 commit comments

Comments
 (0)