HUE+kerberos启动报错Couldn't renew kerberos ticket解决方案

配置好hue+kerberos后，启动报错：

[19/Jan/2018 07:10:08 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:08 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/[email protected]' is still renewable:
  $ klist -f -c /var/run/hue/hue_krb5_ccache
If the 'renew until' date is the same as the 'valid starting' date, the ticket cannot be renewed. Please check your KDC configuration, and the ticket renewal policy (maxrenewlife) for the 'hue/[email protected]' and `krbtgt' principals.
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_NAME SET: /usr/local/hue/desktop/desktop-test.db
[19/Jan/2018 23:10:09 +0000] settings     DEBUG    DESKTOP_DB_TEST_USER SET: hue_test
[19/Jan/2018 07:10:09 +0000] __init__     INFO     Couldn't import snappy. Support for snappy compression disabled.
[19/Jan/2018 07:10:09 +0000] kt_renewer   INFO     Reinitting kerberos from keytab: /usr/bin/kinit -k -t /etc/security/keytabs/hue.service.keytab -c /var/run/hue/hue_krb5_ccache hue/[email protected]
[19/Jan/2018 07:10:10 +0000] kt_renewer   INFO     Renewing kerberos ticket to work around kerberos 1.8.1: /usr/bin/kinit -R -c /var/run/hue/hue_krb5_ccache
kinit: KDC can't fulfill requested option while renewing credentials
[19/Jan/2018 07:10:10 +0000] kt_renewer   ERROR    Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue. Please check that the ticket for 'hue/[email protected]' is still renewable:

执行klist提示：

[root@node1 bin]# klist -f -c /var/run/hue/hue_krb5_ccache
Ticket cache: FILE:/var/run/hue/hue_krb5_ccache
Default principal: hue/[email protected]

Valid starting       Expires              Service principal
01/19/2018 23:06:26  01/20/2018 23:06:26  krbtgt/[email protected]

找到解决方案：

http://www.cloudera.com/documentation/manager/5-1-x/Configuring-Hadoop-Security-with-Cloudera-Manager/cm5chs_enable_hue_sec_s10.html

[root@node1 bin]# kadmin.local
Authenticating as principal hue/[email protected] with password.
kadmin.local:   modprinc -maxrenewlife 90day krbtgt/[email protected]
Principal "krbtgt/[email protected]" modified.
kadmin.local:  modprinc -maxrenewlife 90day +allow_renewable hue/[email protected]
Principal "hue/[email protected]" modified.

另一种解决方法：

https://community.cloudera.com/t5/Cloudera-Manager-Installation/Hue-Kerberos-error-quot-TICKET-NOT-RENEWABLE-quot/m-p/6731#M828

即在/etc/krb5.conf加入：

[libdefaults]
   default_realm = TEST.LAB
   dns_lookup_realm = false
   dns_lookup_kdc = false
   ticket_lifetime = 24h
   renew_lifetime = 7d
   forwardable = true