[AMBARI-11001] Ambari uses users' interactive ticket cache

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Pending Closed
• Affects Version/s: 2.1.0
• Fix Version/s: 2.1.0
• Component/s: ambari-server
• Labels: JAAS
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 07/May/15 18:22
• Updated: 09/Dec/16 03:12
• Resolved: 12/May/15 15:43

Description

It appears that it is necessary to kinit prior to starting ambari-server, even after ambari-server setup-security (#3). It seems that this should be automatically handled by Ambari.

Ambari-server should NOT use the same ticket cache as the interactive user.

STR:
1. kinit
2. ambari-server start
3. verify that ambari-server can authenticate with ticket specified in #1
4. kdestroy
5. try to authenticate through Ambari again (it will not work)

Solution
Ensure JAAS Login works properly such that the Kerberos tickets for the account that executes Ambari is not relevant.

Issue Links

• blocks: AMBARI-11002 Ambari does not renew kerberos tickets