JDK Breakdowns for Web UI and SPNEGO (u92, u91, u40, u45)

Luke Hebert

- One minute read - 164 words

If your Hadoop web UIs suddenly stop responding to SPNEGO logins after a routine JDK patch, the culprit is likely one of the affected 1.8.0 builds. JDK 1.8.0_40 and 1.8.0_45 specifically break SPNEGO and should be replaced. The same class of regression reappeared in 1.8.0_91 and 1.8.0_92, which broke parts of the web interfaces and SPNEGO authentication again.

Symptoms

  • SPNEGO authentication fails against Active Directory.
  • Hadoop web UIs (Hue, Oozie, and similar) return errors or hang during the Kerberos negotiation step.
  • The issue appears immediately after a JDK update to one of the affected builds.

Downgrade to a known-good build such as 1.8.0_71 or 1.8.0_73. After the downgrade, restart the affected services and verify that SPNEGO logins succeed.

You can confirm the currently installed version with:

java -version

A typical output for the problematic build looks like this:

java version "1.8.0_92"
Java(TM) SE Runtime Environment (build 1.8.0_92-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.92-b14, mixed mode)

References