1

I have a kerberised CDH v5.14 cluster with 3 nodes.I trying to call the HDFS API using python as below

baseurl = "http://<host_name>:50070/webhdfs/v1/prod/?op=LISTSTATUS"

__, krb_context = kerberos.authGSSClientInit("HTTP/<host_name>")
#kerberos.authGSSClientStep(krb_context, "")
negotiate_details = kerberos.authGSSClientResponse(krb_context)
headers = {"Authorization": "Negotiate " + str(negotiate_details)}
r = requests.get(baseurl, headers=headers)
print r.status_code

The below error is returned

GSSException: Defective
token detected (Mechanism level: GSSHeader did not find the right tag)

HTTP ERROR 403

But the same works fine when I run it using curl 

curl -i --negotiate -u: http://<host_name>:50070/webhdfs/v1/prod/?op=LISTSTATUS

HTTP/1.1 401 Authentication required Cache-Control: must-revalidate,no-cache,no-store Date: Wed, 30 May 2018 02:50:04 GMT Pragma: no-cache Date: Wed, 30 May 2018 02:50:04 GMT Pragma: no-cache Content-Type: text/html; charset=iso-8859-1 X-FRAME-OPTIONS: SAMEORIGIN WWW-Authenticate: Negotiate Set-Cookie: hadoop.auth=; Path=/; HttpOnly Content-Length: 1409

HTTP/1.1 200 OK Cache-Control: no-cache Expires: Wed, 30 May 2018 02:50:04 GMT Date: Wed, 30 May 2018 02:50:04 GMT Pragma: no-cache Expires: Wed, 30 May 2018 02:50:04 GMT Date: Wed, 30 May 2018 02:50:04 GMT Pragma: no-cache Content-Type: application/json X-FRAME-OPTIONS: SAMEORIGIN WWW-Authenticate: Negotiate YGYGCSqGSIb3EgECAgIAb1cwVaADAgEFoQMCAQ+iSTBHoAMCAReiQAQ+6Seu0SSYGmoqN4hdykSQ55ZcP+juBO/jk8/BGjoK5NCmdlBRFPMSbCZXvVjNHLg9iPACGvM8V0jqXTM5UfQ= Set-Cookie: hadoop.auth="u=XXXX&p=XXXX@HOSTNAME&t=kerberos&e=1527684604664&s=tVsrEsDMBGV0To8hOPp8mLxyiSo="; Path=/; HttpOnly Transfer-Encoding: chunked

and it gives the correct response, what am I missing here? Any help is appreciated.

Vishant
  • 266
  • 5
  • 16
  • Possible duplicate of https://stackoverflow.com/questions/47227276/gssexception-defective-token-detected-when-trying-to-authenticate-to-tomcat – Tagar May 30 '18 at 22:22
  • @Tagar - It's not related to browser, `curl --negotiate` works however when trying to Authenticate using SPNEGO in Python 2.7 and my question is related to the kerberised Hadoop cluster. Do you have any possible answers to this, that would be appreciated. – Vishant May 31 '18 at 01:51

0 Answers0