Failed to obtain/user credentials when Kerberos ticket expires in Hadoop YARN
0 reputation · 18 Jul 2021, 03:40 UTC
When a Kerberos ticket used by a long-running Hadoop job expires, the client throws an AuthenticationFailedException with the message “Failed to obtain/user credentials”, causing the operation to fail unless the ticket is renewed manually or the job is restarted.
The goal is to allow such jobs to continue running without manual re‑login by enabling automatic ticket renewal through JAAS configuration or delegation‑token mechanisms, while keeping the cluster’s least‑privilege security posture intact.
However, the default Hadoop configuration does not renew tickets for user‑submitted jobs, and it is unclear whether setting renewTGT=true in the login module is sufficient across HDFS, YARN and MapReduce, or if additional delegation‑token renewal must be enabled. There is also uncertainty about whether any component silently falls back to simple authentication when tickets expire, which could weaken security.
What configuration is required to guarantee automatic Kerberos ticket renewal for user‑submitted MapReduce jobs? Does enabling renewTGT=true in the JAAS login module cover all Hadoop services, or must delegation‑token renewal be explicitly configured? Are there any version‑specific behaviors or side effects when relying on automatic renewal versus manual keytab refresh?
