Check Hue Credentials and Flags (Kerberos)

Luke Hebert

August 4, 2017 - 3 minutes read - 445 words

When Hue fails to renew its Kerberos ticket, the first thing to check is whether the keytab on disk actually contains the right principal and whether the resulting ticket has the flags Hue needs. The steps below show how to inspect the keytab, perform a test kinit, and read the credential flags.

Locate the Hue Keytab

The keytab lives in the Cloudera SCM agent process directory for the Hue service:

/var/run/cloudera-scm-agent/process/1735-hue-KT_RENEWER

A typical directory listing looks like this:

drwxr-x--x  4 hue  hue   260 Jul 20 15:07 .
drwxr-x--x 11 root root  220 Jul 23 15:06 ..
-rwxr-----  1 hue  hue   398 Jul 20 15:07 altscript.sh
-rw-r-----  1 hue  hue   216 Jul 20 15:07 cloudera-monitor.properties
-rw-r-----  1 hue  hue  1471 Jul 20 15:07 creds.localjceks
-rw-r-----  1 hue  hue  3501 Jul 20 15:07 hue.ini
-rw-------  1 hue  hue   468 Jul 20 15:07 hue.keytab
-rw-r-----  1 hue  hue     0 Jul 20 15:07 hue_safety_valve.ini
drwxr-x--x  2 hue  hue    80 Jul 20 15:07 logs
-rw-r-----  1 hue  hue     0 Jul 20 15:07 redaction-rules.json
-rw-r-----  1 hue  hue  8328 Jul 20 15:07 service-metrics.properties
-rw-------  1 root root 2686 Jul 20 15:07 supervisor.conf
drwxr-xr-x  2 hue  hue   220 Jul 20 15:07 yarn-conf

Inspect the Keytab Contents

Use klist -ekt to list the principals and encryption types stored in the keytab:

# klist -ekt hue.keytab
Keytab name: FILE:hue.keytab
KVNO Timestamp           Principal
---- ----------------- --------------------------------------------------------
   1 06/17/16 14:22:04 hue/hue-1.lab.atx.example.com@LAB.ATX.EXAMPLE.COM (aes256-cts-hmac-sha1-96)
   1 06/17/16 14:22:04 hue/hue-1.lab.atx.example.com@LAB.ATX.EXAMPLE.COM (aes128-cts-hmac-sha1-96)
   1 06/17/16 14:22:04 hue/hue-1.lab.atx.example.com@LAB.ATX.EXAMPLE.COM (arcfour-hmac)
   1 06/17/16 14:22:04 hue/hue-1.lab.atx.example.com@LAB.ATX.EXAMPLE.COM (arcfour-hmac)
   1 06/17/16 14:22:04 hue/hue-1.lab.atx.example.com@LAB.ATX.EXAMPLE.COM (arcfour-hmac)

Perform a Test kinit and Check Flags

Once you confirm the principal is present, use the keytab to obtain a ticket and then inspect the flags:

# kinit -kt hue.keytab hue/hue-1.lab.atx.example.com@LAB.ATX.EXAMPLE.COM
# klist -eaf
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: hue/hue-1.lab.atx.example.com@LAB.ATX.EXAMPLE.COM

Valid starting       Expires              Service principal
08/04/17 12:36:50   08/04/17 22:36:50   krbtgt/LAB.ATX.EXAMPLE.COM@LAB.ATX.EXAMPLE.COM
        renew until 08/11/17 12:36:50, Flags: FRIA
        Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
        Addresses: (none)

In this example the flags are F (Forwardable), R (Renewable), I (Initial), and A (preAuthenticated). Hue specifically requires the R (Renewable) flag so it can renew its ticket without re-authenticating.

Kerberos Credential Flag Reference

The -f option on klist displays the flags present in the credentials using the following abbreviations:

Flag	Meaning
F	Forwardable
f	forwarded
P	Proxiable
p	proxy
D	postDateable
d	postdated
R	Renewable
I	Initial
i	invalid
H	Hardware authenticated
A	preAuthenticated
T	Transit policy checked
O	Okay as delegate
a	anonymous

Important

If the R flag is missing from your ticket, Hue will not be able to renew its Kerberos ticket and will eventually lose access to downstream services. Regenerate the keytab with the renewable option set in your KDC or ticket-granting configuration.