[ATLAS-4535] import-hive.sh fails with kerberos

• Type: Bug
• Status: Reopened
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.1.0
• Component/s: hive-integration
• Assignee: Unassigned
• Reporter: 方磊
• Created: 14/Jan/22 07:32
• Updated: 08/Feb/22 05:29

Description

[INFO] [2022-01-14 15:09:19][org.apache.atlas.hive.bridge.HiveMetaStoreBridge]Found 45 databases
[DEBUG] [2022-01-14 15:09:19][org.apache.thrift.transport.TSaslTransport]writing data length: 35
[DEBUG] [2022-01-14 15:09:19][org.apache.thrift.transport.TSaslTransport]CLIENT: reading data length: 136
[DEBUG] [2022-01-14 15:09:19][org.apache.atlas.hive.bridge.HiveMetaStoreBridge]Searching Atlas for database ads
[DEBUG] [2022-01-14 15:09:19][org.apache.atlas.AtlasBaseClient]------------------------------------------------------
[DEBUG] [2022-01-14 15:09:19][org.apache.atlas.AtlasBaseClient]Call         : GET api/atlas/v2/entity/uniqueAttribute/type/
[DEBUG] [2022-01-14 15:09:19][org.apache.atlas.AtlasBaseClient]Content-type : application/json; charset=UTF-8 
[DEBUG] [2022-01-14 15:09:19][org.apache.atlas.AtlasBaseClient]Accept       : application/json 
[DEBUG] [2022-01-14 15:09:19][org.apache.hadoop.security.UserGroupInformation]PrivilegedAction as:[e-mail] (auth:KERBEROS) from:org.apache.atlas.security.SecureClientUtils$1.getHttpURLConnection(SecureClientUtils.java:94)
[DEBUG] [2022-01-14 15:09:19][org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL]Connecting to url http://dmp01.citicsf.com:21002/api/atlas/v2/entity/uniqueAttribute/type/hive_db?attr%3AqualifiedName=ads%40primary&ignoreRelationships=false&minExtInfo=false with token  as null
[DEBUG] [2022-01-14 15:09:19][org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticatedURL]Token not set, looking for delegation token. Creds:[], size:0
[DEBUG] [2022-01-14 15:09:19][org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator]No delegation token found for url=http://dmp01.citicsf.com:21002/api/atlas/v2/entity/uniqueAttribute/type/hive_db?attr%3AqualifiedName=ads%40primary&ignoreRelationships=false&minExtInfo=false, token=, authenticating with class org.apache.hadoop.security.token.delegation.web.KerberosDelegationTokenAuthenticator$1
[DEBUG] [2022-01-14 15:09:19][org.apache.hadoop.security.authentication.client.KerberosAuthenticator]Using fallback authenticator sequence.
[DEBUG] [2022-01-14 15:09:19][org.apache.hadoop.security.token.delegation.web.DelegationTokenAuthenticator]No delegation token found for url=http://dmp01.citicsf.com:21002/api/atlas/v2/entity/uniqueAttribute/type/hive_db?attr%3AqualifiedName=ads%40primary&ignoreRelationships=false&minExtInfo=false, token=, authenticating with class org.apache.hadoop.security.token.delegation.web.PseudoDelegationTokenAuthenticator$1
[DEBUG] [2022-01-14 15:09:19][org.apache.hadoop.security.UserGroupInformation]PrivilegedActionException as:[e-mail] (auth:KERBEROS) cause:java.io.IOException: org.apache.hadoop.security.authentication.client.AuthenticationException: Authentication failed, URL: http://dmp01.citicsf.com:21002/api/atlas/v2/entity/uniqueAttribute/type/hive_db?attr%3AqualifiedName=ads%40primary&ignoreRelationships=false&minExtInfo=false&user.name=atlas, status: 403, message: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos credentails)
[ERROR] [2022-01-14 15:09:19][org.apache.atlas.hive.bridge.HiveMetaStoreBridge]Import failed
com.sun.jersey.api.client.ClientHandlerException: java.io.IOException: org.apache.hadoop.security.authentication.client.AuthenticationException: Authentication failed, URL: http://dmp01.citicsf.com:21002/api/atlas/v2/entity/uniqueAttribute/type/hive_db?attr%3AqualifiedName=ads%40primary&ignoreRelationships=false&minExtInfo=false&user.name=atlas, status: 403, message: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos credentails)
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:149) ~[jersey-client-1.9.jar:1.9]
        at com.sun.jersey.api.client.Client.handle(Client.java:648) ~[jersey-client-1.9.jar:1.9]
        at com.sun.jersey.api.client.WebResource.handle(WebResource.java:670) ~[jersey-client-1.9.jar:1.9]
        at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74) ~[jersey-client-1.9.jar:1.9]
        at com.sun.jersey.api.client.WebResource$Builder.method(WebResource.java:623) ~[jersey-client-1.9.jar:1.9]
        at org.apache.atlas.AtlasBaseClient.callAPIWithResource(AtlasBaseClient.java:383) ~[atlas-client-common-2.1.0.jar:2.1.0]
        at org.apache.atlas.AtlasBaseClient.callAPIWithResource(AtlasBaseClient.java:353) ~[atlas-client-common-2.1.0.jar:2.1.0]
        at org.apache.atlas.AtlasBaseClient.callAPI(AtlasBaseClient.java:246) ~[atlas-client-common-2.1.0.jar:2.1.0]
        at org.apache.atlas.AtlasClientV2.getEntityByAttribute(AtlasClientV2.java:305) ~[atlas-client-v2-2.1.0.jar:2.1.0]
        at org.apache.atlas.AtlasClientV2.getEntityByAttribute(AtlasClientV2.java:296) ~[atlas-client-v2-2.1.0.jar:2.1.0]
        at org.apache.atlas.hive.bridge.HiveMetaStoreBridge.findEntity(HiveMetaStoreBridge.java:806) ~[hive-bridge-2.1.0.jar:2.1.0]
        at org.apache.atlas.hive.bridge.HiveMetaStoreBridge.findDatabase(HiveMetaStoreBridge.java:771) ~[hive-bridge-2.1.0.jar:2.1.0]
        at org.apache.atlas.hive.bridge.HiveMetaStoreBridge.registerDatabase(HiveMetaStoreBridge.java:413) ~[hive-bridge-2.1.0.jar:2.1.0]
        at org.apache.atlas.hive.bridge.HiveMetaStoreBridge.importDatabases(HiveMetaStoreBridge.java:295) ~[hive-bridge-2.1.0.jar:2.1.0]
        at org.apache.atlas.hive.bridge.HiveMetaStoreBridge.importHiveMetadata(HiveMetaStoreBridge.java:265) ~[hive-bridge-2.1.0.jar:2.1.0]
        at org.apache.atlas.hive.bridge.HiveMetaStoreBridge.main(HiveMetaStoreBridge.java:171) [hive-bridge-2.1.0.jar:2.1.0]
Caused by: java.io.IOException: org.apache.hadoop.security.authentication.client.AuthenticationException: Authentication failed, URL: http://dmp01.citicsf.com:21002/api/atlas/v2/entity/uniqueAttribute/type/hive_db?attr%3AqualifiedName=ads%40primary&ignoreRelationships=false&minExtInfo=false&user.name=atlas, status: 403, message: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos credentails)
        at org.apache.atlas.security.SecureClientUtils$1$1.run(SecureClientUtils.java:101) ~[atlas-client-common-2.1.0.jar:2.1.0]
        at org.apache.atlas.security.SecureClientUtils$1$1.run(SecureClientUtils.java:94) ~[atlas-client-common-2.1.0.jar:2.1.0]
        at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_181]
        at javax.security.auth.Subject.doAs(Subject.java:422) ~[?:1.8.0_181]
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1875) ~[hadoop-common-3.0.0-cdh6.3.2.jar:?]
        at org.apache.atlas.security.SecureClientUtils$1.getHttpURLConnection(SecureClientUtils.java:94) ~[atlas-client-common-2.1.0.jar:2.1.0]
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:159) ~[jersey-client-1.9.jar:1.9]
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:147) ~[jersey-client-1.9.jar:1.9]