title: HBase+Kerberos: UserGroupInformation logging in from keytab expires?
body: <p>We are using the method <code>UserGroupInformation.loginUserFromKeytabAndReturnUGI(user, keytab)</code>
  to authenticate a Java program to write to a remote HBase cluster. When the application first starts up we are all good and it's talking to HBase happily.</p>
  
  <p>The krb5.conf ticket_lifetime is set to 24 hours, and what seems to happen after 24 hours is that the "TGT expires" and we start seeing exceptions like this: <code>Exception encountered while connecting to the server : javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
  </code></p>
  
  <p>We don't have any relogin logic. I always thought logging in from keytab shouldn't require us to write any additional code to relogin since it's handled by the RpcClient. But here are a few weird things:</p>
  
  <ol>
  <li><p>Looks like some mechanism to relogin is kicking in but not doing anything, I'm not sure what method it tries to use <code>org.apache.hadoop.security.UserGroupInformation Not attempting to re-login since the last re-login was attempted less than 600 seconds before.</code></p></li>
  <li><p>When initially authenticated via keytab, <code>isFromKeytab()</code> returns FALSE! I wonder if this is why it's not trying to use reloginFromKeytab() and tries to look at the cache?</p></li>
  </ol>
  
  <p>Should we try to catch the exception and use <code>checkTGTAndReloginFromKeytab()</code> or do something like this?</p>
  
  <pre><code>         if (UserGroupInformation.isLoginKeytabBased()) {
              UserGroupInformation.getLoginUser().reloginFromKeytab();
            } else if (UserGroupInformation.isLoginTicketBased()) {
              UserGroupInformation.getLoginUser().reloginFromTicketCache();
            }
  </code></pre>
  
  <p>Any help is appreciated!</p>
  
  <p>Jason</p>