{"action":"created","issue":{"url":"https://api.github.com/repos/azkaban/azkaban/issues/587","repository_url":"https://api.github.com/repos/azkaban/azkaban","labels_url":"https://api.github.com/repos/azkaban/azkaban/issues/587/labels{/name}","comments_url":"https://api.github.com/repos/azkaban/azkaban/issues/587/comments","events_url":"https://api.github.com/repos/azkaban/azkaban/issues/587/events","html_url":"https://github.com/azkaban/azkaban/issues/587","id":121297040,"number":587,"title":"Kerberos Question","user":{"login":"todd-fritz","id":5742711,"avatar_url":"https://avatars.githubusercontent.com/u/5742711?v=3","gravatar_id":"","url":"https://api.github.com/users/todd-fritz","html_url":"https://github.com/todd-fritz","followers_url":"https://api.github.com/users/todd-fritz/followers","following_url":"https://api.github.com/users/todd-fritz/following{/other_user}","gists_url":"https://api.github.com/users/todd-fritz/gists{/gist_id}","starred_url":"https://api.github.com/users/todd-fritz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/todd-fritz/subscriptions","organizations_url":"https://api.github.com/users/todd-fritz/orgs","repos_url":"https://api.github.com/users/todd-fritz/repos","events_url":"https://api.github.com/users/todd-fritz/events{/privacy}","received_events_url":"https://api.github.com/users/todd-fritz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-09T17:24:19Z","updated_at":"2016-06-09T17:54:41Z","closed_at":null,"body":"Does each flow need to do a kinit and build the ticket cache itself, or does Azkaban handle that? I see the code where a job buids the name of the ticket cache that is specific to a job, but don't see where it is created.  If a shell script calls a utility such as hdfs via a command job type, how is the ticket known by the hadoop client?\r\n\r\n```java \r\nProcessJob.java\r\n\r\n  private String getKrb5ccname(Props jobProps) {\r\n    String effectiveUser = getEffectiveUser(jobProps);\r\n    String projectName =\r\n        jobProps.getString(CommonJobProperties.PROJECT_NAME).replace(\" \", \"_\");\r\n    String flowId =\r\n        jobProps.getString(CommonJobProperties.FLOW_ID).replace(\" \", \"_\");\r\n    String jobId =\r\n        jobProps.getString(CommonJobProperties.JOB_ID).replace(\" \", \"_\");\r\n    // execId should be an int and should not have space in it, ever\r\n    String execId = jobProps.getString(CommonJobProperties.EXEC_ID);\r\n    String krb5ccname =\r\n        String.format(\"/tmp/krb5cc__%s__%s__%s__%s__%s\", projectName, flowId,\r\n            jobId, execId, effectiveUser);\r\n\r\n    return krb5ccname;\r\n  }\r\n```\r\n\r\nAnd putting it in the environment:\r\n``` java\r\n    // change krb5ccname env var so that each job execution gets its own cache\r\n    Map<String, String> envVars = getEnvironmentVariables();\r\n    envVars.put(KRB5CCNAME, getKrb5ccname(jobProps));\r\n```\r\n\r\nWith the env variable containing the ticket cache named \"KRB5CCNAME\".\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/azkaban/azkaban/issues/comments/224975098","html_url":"https://github.com/azkaban/azkaban/issues/587#issuecomment-224975098","issue_url":"https://api.github.com/repos/azkaban/azkaban/issues/587","id":224975098,"user":{"login":"mikebaldinoiii","id":2425549,"avatar_url":"https://avatars.githubusercontent.com/u/2425549?v=3","gravatar_id":"","url":"https://api.github.com/users/mikebaldinoiii","html_url":"https://github.com/mikebaldinoiii","followers_url":"https://api.github.com/users/mikebaldinoiii/followers","following_url":"https://api.github.com/users/mikebaldinoiii/following{/other_user}","gists_url":"https://api.github.com/users/mikebaldinoiii/gists{/gist_id}","starred_url":"https://api.github.com/users/mikebaldinoiii/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikebaldinoiii/subscriptions","organizations_url":"https://api.github.com/users/mikebaldinoiii/orgs","repos_url":"https://api.github.com/users/mikebaldinoiii/repos","events_url":"https://api.github.com/users/mikebaldinoiii/events{/privacy}","received_events_url":"https://api.github.com/users/mikebaldinoiii/received_events","type":"User","site_admin":false},"created_at":"2016-06-09T17:54:41Z","updated_at":"2016-06-09T17:54:41Z","body":"I'm running into this as well. The answer is you do need to do a kinit within each job because its appending the flow/job information instead of the uid of the username: \r\n\r\n$ id\r\nuid=1665152075(azkaban)\r\n\r\nThis is the error: \r\n\r\nklist: No credentials cache found (ticket cache FILE:/tmp/krb5cc__test_project__test_job__test_job__31__azkaban)\r\n\r\nThis is where the ticket actually is: \r\nTicket cache: FILE:/tmp/krb5cc_1665152075\r\n"}}
{"actor":{"display_login":"mikebaldinoiii"}}