Search code examples
kerberoshue

Cloudera Hue GSSError: No Kerberos credentials available


Receive multiple of the same error when logging into Hue

GSSError: (('Unspecified GSS failure.  Minor code may provide more information', 851968), 
('No Kerberos credentials available (default cache: /var/run/hue/hue_krb5_ccache)

hue.ini is configured for Kerberos

[[kerberos]]
    hue_keytab=/etc/security/keytabs/hue.keytab
    hue_principal=hue/_HOST@REALM

[beeswax]
    auth_username=hue
    use_sasl=true

 [hadoop]
   [[hdfs_clusters]]
     [[[default]]]
        security_enabled=true

   [[yarn_clusters]]
     [[[default]]]
       # Change this if your YARN cluster is Kerberos-secured
       security_enabled=true

Hue is running as the hue user and has access to the credentials cache directory and the keytab referenced in the configuration.


Solution

  • Receiving this error likely means the kt_renewer service isn't running.

    This means kinit isn't being executed and there are no credentials stored for Hue to use.

    Credential Cache

    By default Hue (4.6) caches Kerberos credentials in a file at: /var/run/hue/hue_krb5_ccache

    To verify if any credentials have been cached you can use klist

    klist "/var/run/hue/hue_krb5_ccache"
    
    Ticket cache: FILE:/var/run/hue/hue_krb5_ccache
    Default principal: hue/_HOST@REALM
    
    Valid starting       Expires              Service principal
    03/05/2020 16:06:38  03/06/2020 16:06:38  krbtgt/_HOST@REALM
    

    kt_renewer

    You should also execute the renewer manually to see if it throws any errors such as permissions problems.

    Run kt_renewer

    /opt/hue/build/env/bin/hue kt_renewer