Uploaded image for project: 'Ambari'
  1. Ambari
  2. AMBARI-9785

Root user has spnego (HTTP) kerberos ticket set after Kerberos is enabled, root should have no ticket.

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Blocker
    • Resolution: Fixed
    • 2.0.0
    • 2.0.0
    • ambari-agent

    Description

      After enabling Kerberos, the root user has the spnego user set for it 

      [root@c6501 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: HTTP/c6501.ambari.apache.org@EXAMPLE.COM

Valid starting     Expires            Service principal
02/18/15 22:14:51  02/19/15 22:14:51  krbtgt/EXAMPLE.COM@EXAMPLE.COM
	renew until 02/18/15 22:14:51

      It appears that the issue is related to the agent-side scheduler and/or some job that is scheduled to run periodically. Apparently some job is kinit-ing with the SPNEGO identity as the running user (root in this case) without changing the ticket cache. Thus whenever the job runs the root user's ticket cache gets changed to contain the SPNEGO identity's ticket.

      Attachments

        1. AMBARI-9785_03.patch
          57 kB
          Robert Levas
        2. AMBARI-9785_02.patch
          57 kB
          Robert Levas
        3. AMBARI-9785_01.patch
          20 kB
          Robert Levas

        Issue Links

          links to

          Web Link ReviewBoard

          Activity

            People

              rlevas Robert Levas
              rlevas Robert Levas
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: