Zookeeper configures the pit of kerberos authentication
After zookeeper is configured with kerberos, the zkCli.sh connection authentication fails.
Connection command: zkCli.sh
The error is as follows:
WatchedEvent state:SyncConnected type:None path:null2017-08-21 10 ERROR 11V 42054 [myid:]-ERROR [main-SendThread (localhost:2181): ZooKeeperSaslClient@308]-An error: (java.security.PrivilegedActionException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7)-LOOKING_UP_SERVER)]) occurred when evaluating Zookeeper Quorum Member's received SASL token. Zookeeper Client will go to AUTH_FAILED state.2017-08-21 10 ERROR 11main-SendThread 42054 [myid:]-ERROR [main-SendThread (localhost:2181): ClientCnxn$SendThread@1072]-SASL authentication with Zookeeper Quorum member failed: javax.security.sasl.SaslException: An error: (java.security.PrivilegedActionException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7)-LOOKING_UP_SERVER)]) occurred when evaluating Zookeeper Quorum Member's received SASL token. Zookeeper Client will go to AUTH_FAILED state.
After searching for a long time, I finally found a clue in kdc's log, as follows
Aug 21 10:11:42 master krb5kdc [21935] (info): TGS_REQ (6 etypes {18 17 16 23 13}) 192.168.100.144: LOOKING_UP_SERVER: authtime 0, zkcli@NETEASE.COM for zookeeper/localhost@NETEASE.COM, Server not found in Kerberos database
Reason analysis: 1. In the authentication request of zookeeper, the default principall of zookeeper should be zookeeper/@.
2. When using zkCli.sh method to request, the default host should be localhost.
Therefore, it is found that the client request is authenticated with the principal of zookeeper/localhost@NETEASE.COM in kdc, but there is no such principal in the database of kerberos.
Solution: use zkCli.sh-server host:port access. At the same time, the principal in the sever part of the zookeeper configuration file must be zookeeper/@.
