[HADOOP-12426] Add Entry point for Kerberos health check

• Type: New Feature
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.7.1
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: security
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed
• Release Note: Hadoop now includes a shell command named KDiag that helps with diagnosis of Kerberos misconfiguration problems. Please refer to the Secure Mode documentation for full details on usage of the command.
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 21/Sep/15 11:29
• Updated: 18/Dec/17 18:44
• Resolved: 06/Feb/16 00:01

Description

If we a little command line entry point for testing kerberos settings, including some automated diagnostics checks, we could simplify fielding the client-side support calls.

Specifically

• check JRE for having java crypto extensions at full key length.
• network checks: do you know your own name?
• Is the user kinited in?
• if a tgt is specified, does it exist?
• are hadoop security options consistent?

Issue Links

• depends upon: SLIDER-1027 add a kdiag command for kerberos diagnostics
• depends upon: HADOOP-12649 Improve Kerberos diagnostics and failure handling
• is related to: HADOOP-15123 KDiag tries to load krb5.conf from KRB5CCNAME instead of KRB5_CONFIG