Load a keytab from HDFS

Question

I want to use Oozie with a Java Action which needs to use Kerberos. I have my keytab in HDFS. How could I say that the file is in HDFS?

 Configuration conf = new Configuration();
 conf.set("hadoop.security.authentication", "Kerberos");     
 UserGroupInformation.setConfiguration(conf);
 UserGroupInformation.loginUserFromKeytab(kerberosPrincipal, kerberosKeytab);

I have tried with a path like hdfs://xxxx:8020/tmp/myKeytab.keytab and I set conf.set("fs.defaultFS", "hdfs://server:8020"); as well but it doesn't work.

Answer 1

Hadoop delegation tokens work only for YARN and HDFS, and they expire after 7 days. For all other services -- especially HBase (via ZooKeeper), HiveServer2 (directly or via ZooKeeper), Hive Metastore (inside Hive CLI) -- you need to authenticate directly. For long-running services, you need to re-authenticate periodically to renew the delegation token (if you rely on Slider, it does that automatically for you)

Option 1 : ask Oozie to generate the appropriate <credential> for your Action. I wish it really worked out-of-the-box and/or that it was better documented -- Hive works like a charm; not so with HBase; never tried Hive2 so I can't be sure.

Option 2 : ask Oozie to download your custom keytab file from HDFS (you took care of restricting access to that keytab, didn't you???) to the CWD of your Launcher container with a <file> option, then generate your credentials all by yourself.

With a Java action it will be option 2.