[IMPALA-4507] Print kerberos minor code even for unspecified errors

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: Impala 2.2.4
• Component/s: Backend
• Labels: supportability
• Assignee: Unassigned
• Reporter: Mala Chikka Kempanna
• Created: 17/Nov/16 19:31
• Updated: 17/Nov/16 19:40
• Resolved: 17/Nov/16 19:40

Description

Whenever there is unspecified error bubbling up from Kerberos API calls, impala does not print the minor code:
At present , the error message looks like -

"SASL message (Kerberos (external)): GSSAPI Error: Unspecified GSS failure. Minor code may provide more information ()"

It will help if specific minor code is printed.

For eg like-
GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown code krb5 194)

Error code 194 refers to "Credentials cache file permissions incorrect". In this situation you are probably using a cron job to create a ticket but the LDAP user cannot read the ticket cache file. Make sure the cache file is owned by the user trying to make the client connection.

OR

GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Unknown code krb5 195)

This can happen if you simply have not done a kinit if you are working from the command line. However, in the case of a service it may mean that client process cannot find the ticket cache file. You will need to let the LDAP server know where the cache file is.