Does Apache Phoenix automatically renew Kerberos tickets for long-running queries?

Question

Goal: Determine whether Phoenix handles Kerberos ticket renewal automatically for queries that exceed the default ticket lifetime.

Phoenix delegates authentication to the HBase security layer.
The HBase client can renew tickets if a renewal interval is configured, but Phoenix does not expose a setting to control this behavior.
Ticket lifetimes vary (e.g., 10 minutes in test clusters) and long‑running analytical queries may exceed them.

Does the HBase client automatically renew Kerberos tickets during a Phoenix query when renewal is enabled? If not, what mechanisms can prevent query failure due to expired tickets? Is there a way for Phoenix to propagate renewal settings to the underlying HBase client?

Tasadduq Burney · Answer

Short answer

No. Apache Phoenix does not automatically renew Kerberos tickets for long-running queries. Phoenix delegates authentication to the HBase security layer, so ticket renewal is a property of the Kerberos login environment and the HBase client, not a Phoenix setting.

Confirmed behavior versus likely explanation

Item	Status
Phoenix exposes a ticket-renewal interval	No standard setting
Renewal depends on a renewable TGT and login configuration	Expected in HBase/Hadoop Kerberos
Expired ticket during a long scan can fail the query	Possible; may surface as GSSAPI/Kerberos failures

A renewable ticket must be renewed before its end time. If the ticket expires while a Phoenix query is running, the underlying HBase scan may fail or partially fail; Phoenix itself does not restart the Kerberos exchange on the user's behalf.

Steps for this case

Create a renewable ticket with a keytab: kinit -kt <keytab> <principal> -l <lifetime> -r <renew-till>
Confirm the ticket shows a renewable lifetime: klist -e
Renew before expiry using kinit -R or krenew, scheduled well before the renew-till limit.
Use the same principal and keytab for the Phoenix client and HBase, and keep hbase.security.authentication=kerberos in hbase-site.xml.

Missing diagnostic detail

Are you using embedded Phoenix JDBC or the Phoenix Query Server thin client? Renewal configuration and JAAS login placement can differ between these modes, so this determines where to apply the client-side Kerberos settings.

Verification

Run klist -e after kinit and confirm renew-till is later than the expected query duration.
Inspect core-site.xml, hbase-site.xml, krb5.conf, and the client JAAS configuration for matching principals.
Test a scan longer than the ticket lifetime in non-production with renewal enabled and disabled, capturing HBase/Phoenix logs for authentication failures.

Assumptions and uncertainty

This assumes Kerberos is enabled for HBase. Exact behavior can vary by Phoenix, HBase, and Hadoop version, and by client mode. Treat version-specific renewal defaults as unverified until tested in your environment.

Does Apache Phoenix automatically renew Kerberos tickets for long-running queries?

1 answer

Short answer

Confirmed behavior versus likely explanation

Steps for this case

Missing diagnostic detail

Verification

Assumptions and uncertainty

Your perspective belongs here.

0 question comments