Webhdfs Output plugin does not login with Keytab

(Felipe Manzur) #1


I configured a pipeline using the webhdfs output plugin, but i'm having trouble to login into kerberos using a keytab.

If i login by command line using the keytab "kinit -kt <keytab_file> " , i get the kerberos ticket and the pipeline works perfectly however if i destroy the kerberos ticket and i run the pipeline, the plugin is not able to login using the keytab.

Do you know if there's a bug with this plugin?.. or maybe the problem is the GSSAPI gem that is using to login into kerberos?

Webhdfs conf

webhdfs {
host => ""
port => 14000
standby_host => ""
standby_port => 14000
path => "/tmp/test.log"
user => "kerberos_user"
kerberos_keytab => "/tmp/kerberos_user.keytab"
use_kerberos_auth => true

The error

[ERROR][logstash.outputs.webhdfs ] Max write retries reached. Events will be discarded. Exception: gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure. Minor code may provide more information
Credentials cache file '/tmp/krb5cc_489' not found

(Sara) #2

I have the same problem as well. I set the properties related to Kerberos authentication and it seems that Logstash is not taking into account the keytab file. The pipeline works perfectly when I perform a kinit before running it.

I thought that Logstash performed the kinit internally using the provided credentials, am I missing something here?

(DCereijo) #3

Same issue

(kerbZR) #4

Try to add in your webhdfs conf 'single_file_per_thread => true', let me know if that works!

(Sara) #5

it does not work, same error..

(Felipe Manzur) #6

Thanks but that parameter has nothing todo with Kerberos auth. However i tried it and it didn't worked.

(Felipe Manzur) #7

somebody help!

(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.