Read-only filesystem pod with Spring Boot application on Kubernetes - java

I have a Docker container with Spring Boot 3.0.0 application running in the Kubernetes Deployment.
I have received a number of hardening rules that are required to be implemented, such as:
do not mount emptyDir volumes to pods
define runAsNonRoot in securityContext of pods
pods must define, that their filesystem is mounted readonly using readOnlyRootFilesystem: true in securityContext
My application stores data in the database and does not need any write permissions to the filesystem, so I have tried to define securityContext in my Deployment using:
securityContext:
runAsNonRoot: true
readOnlyRootFilesystem: true
However, running the Deployment failed, and it seems that the Spring Boot is trying to create some temporary directory, which of course is not allowed:
[2023-02-01 15:12:31.762] ERROR [main] [org.springframework.boot.SpringApplication - 820]: Application run failed
org.springframework.context.ApplicationContextException: Unable to start web server
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:164)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:578)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:146)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:730)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:432)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:308)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1302)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1291)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:95)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:65)
Caused by: org.springframework.boot.web.server.WebServerException: Unable to create tempDir. java.io.tmpdir is set to /tmp
at org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir(AbstractConfigurableWebServerFactory.java:208)
at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.getWebServer(TomcatServletWebServerFactory.java:194)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.createWebServer(ServletWebServerApplicationContext.java:183)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:161)
... 16 common frames omitted
Caused by: java.nio.file.FileSystemException: /tmp/tomcat.8080.8311954706877871713: Read-only file system
at java.base/sun.nio.fs.UnixException.translateToIOException(Unknown Source)
at java.base/sun.nio.fs.UnixException.rethrowAsIOException(Unknown Source)
at java.base/sun.nio.fs.UnixException.rethrowAsIOException(Unknown Source)
at java.base/sun.nio.fs.UnixFileSystemProvider.createDirectory(Unknown Source)
at java.base/java.nio.file.Files.createDirectory(Unknown Source)
at java.base/java.nio.file.TempFileHelper.create(Unknown Source)
at java.base/java.nio.file.TempFileHelper.createTempDirectory(Unknown Source)
at java.base/java.nio.file.Files.createTempDirectory(Unknown Source)
at org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir(AbstractConfigurableWebServerFactory.java:202)
... 19 common frames omitted
I was trying to find some relevant information on the web and this tells me that read-only containers are not supported in Spring Boot: https://github.com/spring-projects/spring-boot/issues/8578.
There are some proposed solutions, which I cannot apply, for example to use emptyDir mount, or pvc. It does not make sense for me to mount something just because Spring Boot needs to create temporary directory.
Does anyone has experience with that and can suggest a good solution how to create Deployment with Spring Boot pod that works when readOnlyRootFilesystem: true?

Related

cannot start cas-overlay-template on windows - missing \etc\cas\thekeystore

I am trying to run https://github.com/apereo/cas-overlay-template on Windows 11 and JDK 11 (Eclipse Adoptium 11.0.16.1), using the 6.5 branch. I have ran the "createKeystore" and "copyCasConfiguration" gradle tasks using gradlew.bat, and it created the files below:
c:/etc/cas/cas.crt
c:/etc/cas/thekeystore
c:/etc/cas/config/cas.properties
c:/etc/cas/config/log4j2.xml
when I tried to run "gradlew.bat run", it hit the following error:
2022-08-22 20:26:06,670 WARN [org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext] - <Exception encountered during context initialization - cancelling refresh attempt: org.springframework.context.ApplicationContextException: FaException in thread "main" java.lang.reflect.InvocationTargetException
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:108)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
at org.springframework.boot.loader.WarLauncher.main(WarLauncher.java:59)
Caused by: org.springframework.context.ApplicationContextException: Failed to start bean 'webServerStartStop'; nested exception is org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat server
at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:181)
at org.springframework.context.support.DefaultLifecycleProcessor.access$200(DefaultLifecycleProcessor.java:54)
at org.springframework.context.support.DefaultLifecycleProcessor$LifecycleGroup.start(DefaultLifecycleProcessor.java:356)
at java.base/java.lang.Iterable.forEach(Iterable.java:75)
at org.springframework.context.support.DefaultLifecycleProcessor.startBeans(DefaultLifecycleProcessor.java:155)
at org.springframework.context.support.DefaultLifecycleProcessor.onRefresh(DefaultLifecycleProcessor.java:123)
at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:935)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:586)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:145)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:732)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:414)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:302)
at org.springframework.boot.builder.SpringApplicationBuilder.run(SpringApplicationBuilder.java:164)
at org.apereo.cas.web.CasWebApplication.main(CasWebApplication.java:62)
... 8 more
Caused by: org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat server
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:229)
at org.springframework.boot.web.servlet.context.WebServerStartStopLifecycle.start(WebServerStartStopLifecycle.java:43)
at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:178)
... 21 more
Caused by: java.lang.IllegalArgumentException: standardService.connector.startFailed
at org.apache.catalina.core.StandardService.addConnector(StandardService.java:238)
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.addPreviouslyRemovedConnectors(TomcatWebServer.java:282)
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:213)
... 23 more
Caused by: org.apache.catalina.LifecycleException: Protocol handler start failed
at org.apache.catalina.connector.Connector.startInternal(Connector.java:1077)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.StandardService.addConnector(StandardService.java:234)
... 25 more
Caused by: java.lang.IllegalArgumentException: \etc\cas\thekeystore (The system cannot find the path specified)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:107)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:235)
at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1227)
at org.apache.tomcat.util.net.AbstractEndpoint.start(AbstractEndpoint.java:1313)
at org.apache.coyote.AbstractProtocol.start(AbstractProtocol.java:614)
at org.apache.catalina.connector.Connector.startInternal(Connector.java:1074)
... 27 more
Caused by: java.io.FileNotFoundException: \etc\cas\thekeystore (The system cannot find the path specified)
at java.base/java.io.FileInputStream.open0(Native Method)
at java.base/java.io.FileInputStream.open(FileInputStream.java:219)
at java.base/java.io.FileInputStream.<init>(FileInputStream.java:157)
at java.base/java.io.FileInputStream.<init>(FileInputStream.java:112)
at java.base/sun.net.www.protocol.file.FileURLConnection.connect(FileURLConnection.java:86)
at java.base/sun.net.www.protocol.file.FileURLConnection.getInputStream(FileURLConnection.java:184)
at org.apache.catalina.startup.CatalinaBaseConfigurationSource.getResource(CatalinaBaseConfigurationSource.java:118)
at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:199)
at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:207)
at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:283)
at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:247)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:105)
... 33 more
I believe this is due to Gradle thinking its running inside a Unix environment instead of a Windows one. Any changes I make to the c:/etc/cas/config/cas.properties file is ignored, which makes me believe that its looking elsewhere for the cas folder (not c:/etc/cas). Anyone got any ideas?
You can change the keystore location in spring config. You can pass the property either in cas.properties or with command line flags or ENV. Two examples:
Example: absolute windwos path
server.ssl.key-store=D:/dev/cas/etc/theKeystore.jks
Example: relative path
server.ssl.key-store=file:etc/cas/thekeystore
By the way, you can also change the location of the cas.properties file with the cas.standalone.configurationDirectory parameter. This is how I usually work in a local environment on Windows:
java -jar build/libs/cas.war --cas.standalone.configurationDirectory=etc/cas/config --debug
Anyone got any ideas?
Please read:
https://apereo.github.io/cas/6.5.x/installation/Troubleshooting-Guide.html#review-logs
CAS server logs are the best resource for determining the root cause of the problem, provided you have configured the appropriate log levels. Specifically you want to make sure DEBUG levels are turned on the org.apereo package in the log configuration
You could consider moving the configuration inside the CAS build itself in an application.yml file, instead of keeping it outside.
https://apereo.github.io/cas/6.5.x/configuration/Configuration-Server-Management-Standalone.html
Try switching from tomcat to jetty as an embedded servlet server. It seems to have better windows support, and properly looks for c:\etc\cas\thekeystore.
To do that just replace -tomcat with -jetty as appServer in the gradle.properties file.
There might be a way to teach tomcat to look at the right place, but I didn't found it. The server.ssl.key-store setting didn't had any effect.

Windows authentication fails to connect after Java update

We have an application which front end is on running on Tomcat 8.5, IIS 8.5 configured with isapi redirect. Everthing is working fine with java 8.92. But after upgrading Java to 8.211 windows authentication fails to connect with error
SOAP Fault occurred: Fault string, and possibly fault code, not set
Is there any configuration needs to be changed after Java update?
EDIT:
We have recreated Tomcat services after Java update. And if we enabe Anonymous Authentication in IIS everything works fine. But when only Windows Authentication is enabled in IIS we got that authentication failed error. There is only one error in logs
SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[HTTP/1.1-1443]]
org.apache.catalina.LifecycleException: Protocol handler initialization failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:995)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:552)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:848)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
at org.apache.catalina.startup.Catalina.load(Catalina.java:639)
at org.apache.catalina.startup.Catalina.load(Catalina.java:662)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:303)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:473)
Caused by: java.lang.IllegalArgumentException
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:100)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:72)
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:244)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1118)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:223)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:581)
at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:70)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:993)
... 13 more
Caused by: java.io.IOException
at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:301)
at org.apache.tomcat.util.net.openssl.OpenSSLUtil.getKeyManagers(OpenSSLUtil.java:98)
at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:246)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:98)

Unable to create tempDir. java.io.tmpdir is set to /tmp

Running my springboot web service java jar app on ubuntu server results in the error shown below, I have done a bit of research about the error however I cannot get a solution. The command I am using to run the jar file is
java -jar mySpringBootApp.jar
org.springframework.context.ApplicationContextException: Unable to start web server; nested exception is org.springframework.boot.web.server.WebServerException: Unable to create tempDir. java.io.tmpdir is set to /tmp
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:157) ~[spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:540) ~[spring-context-5.1.3.RELEASE.jar!/:5.1.3.RELEASE]
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:142) ~[spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:775) [spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:397) [spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.SpringApplication.run(SpringApplication.java:316) [spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1260) [spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1248) [spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at aacctt.payments.org.Application.main(Application.java:18) [classes!/:0.0.1-SNAPSHOT]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_191]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_191]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_191]
at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_191]
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:48) [ mySpringBootApp-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
at org.springframework.boot.loader.Launcher.launch(Launcher.java:87) [ mySpringBootApp-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
at org.springframework.boot.loader.Launcher.launch(Launcher.java:50) [ mySpringBootApp-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:51) [ mySpringBootApp-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
Caused by: org.springframework.boot.web.server.WebServerException: Unable to create tempDir. java.io.tmpdir is set to /tmp
at org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir(AbstractConfigurableWebServerFactory.java:182) ~[spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.getWebServer(TomcatServletWebServerFactory.java:162) ~[spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.createWebServer(ServletWebServerApplicationContext.java:181) ~[spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:154) ~[spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
... 16 common frames omitted
Caused by: java.io.IOException: Read-only file system
at java.io.UnixFileSystem.createFileExclusively(Native Method) ~[na:1.8.0_191]
at java.io.File.createTempFile(File.java:2024) ~[na:1.8.0_191]
at java.io.File.createTempFile(File.java:2070) ~[na:1.8.0_191]
at org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir(AbstractConfigurableWebServerFactory.java:173) ~[spring-boot-2.1.1.RELEASE.jar!/:2.1.1.RELEASE]
... 19 common frames omitted
Try any of the following:
1) Change permissions of /tmp to give access to your user.
chmod -R 777 /tmp
make you sure you run above command with sudo access (root)
2) add the user who is to the sudo group.
In case you are getting this issue while deploying Spring boot application in Kubernetes, one of configuration worth checking is readOnlyRootFilesystem. It must be set to false until you are trying to intentionally run read only containers.
It can be used in deployment config as following:
template:
metadata:
labels:
app: hello
spec:
containers:
- name: hello
image: hello-world
securityContext:
runAsUser: 1000
readOnlyRootFilesystem: false ## this should not be true
For ones who are getting same exception while running from Intellij IDEA when providing env variables as part of run/debug configuration:
please look if "Include parent environment variables" is checked
your application user probably does not have sufficient permissions to crate anything in /tmp directory ... see last message Caused by: java.io.IOException: Read-only file system
The most likely explanation for this is that the root filesystem is full. It was the issue for me.
One reason for this error is that you not include system environments variables. Maybe you try to define a new configuration with different system variables that are defined in your java IDE and you disable default environments variable.
Please enable checkbox:
Run/Debug Configuration -> select your configuration -> press on the environment variables -> check Include system environment variables (as in the picture added above).
Keep in mind that you need to check if you have added the path of the Temp file in the system variables.

Kerberos Authentication Error - When loading Hadoop Config Files from SharedPath

I am developing an Java Application and this application is saving a result data to HDFS. The java Application should run in my windows machine.
We using Kerberos Authentication and we placed a keytab file in NAS drive. And we saved Hadoop config Files in the same NAS drive.
My issues is when I load the Hadoop config files from NAS drive, Its throwing me some Authetication error, But my application is running fine if I load the config files from my local File System (I also saved the config files inside C:\Hadoop)
Below is my working code snippet. (keytab file in NAS, Hadoop config files in local file system)
static String KeyTabPath = "\\\\path\\2\\keytabfile\\name.keytab"
Configuration config = new Configuration();
config.set("fs.defaultFS", "hdfs://xxx.xx.xx.com:8020");
config.addResource(new Path("C:\\Hadoop\\core-site.xml"));
config.addResource(new Path("C:\\Hadoop\\hdfs-site.xml"));
config.addResource(new Path("C:\\Hadoop\\mapred-site.xml"));
config.addResource(new Path("C:\\Hadoop\\yarn-site.xml"));
config.set("fs.hdfs.impl", org.apache.hadoop.hdfs.DistributedFileSystem.class.getName());
config.set("fs.file.impl",org.apache.hadoop.fs.LocalFileSystem.class.getName());
// Kerberos Authentication
config.set("hadoop.security.authentication", "Kerberos");
UserGroupInformation.setConfiguration(config);
UserGroupInformation.loginUserFromKeytab("name#xx.xx.COM",KeyTabPath);
I tried loading config files also from the NAS drive but getting kerberos authentication error.
Below is the code snippet which throwing error (Keytab file in NAS and Hadoop config files also in NAS)
static String KeyTabPath = "\\\\path\\2\\keytabfile\\name.keytab"
Configuration config = new Configuration();
config.set("fs.defaultFS", "hdfs://xxx.xx.xx.com:8020");
config.addResource(new Path("\\\\NASDrive\\core-site.xml"));
config.addResource(new Path("\\\\NASDrive\\hdfs-site.xml"));
config.addResource(new Path("\\\\NASDrive\\mapred-site.xml"));
config.addResource(new Path("\\\\NASDrive\\yarn-site.xml"));
config.set("fs.hdfs.impl", org.apache.hadoop.hdfs.DistributedFileSystem.class.getName());
config.set("fs.file.impl",org.apache.hadoop.fs.LocalFileSystem.class.getName());
// Kerberos Authentication
config.set("hadoop.security.authentication", "Kerberos");
UserGroupInformation.setConfiguration(config);
UserGroupInformation.loginUserFromKeytab("name#xx.xx.COM",KeyTabPath);
Below is the Error Message
java.io.IOException: Login failure for name#XX.XX.COM from keytab \\NASdrive\name.keytab: javax.security.auth.login.LoginException: java.lang.IllegalArgumentException: Illegal principal name name#XX.XX.COM: org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No rules applied to name#XX.XX.COM
at org.apache.hadoop.security.UserGroupInformation.loginUserFromKeytab(UserGroupInformation.java:962)
at Appname.ldapLookupLoop(Appname.java:111)
at Appname.main(Appname.java:70)
Caused by: javax.security.auth.login.LoginException: java.lang.IllegalArgumentException: Illegal principal name name#XX.XX.COM: org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No rules applied to name#XX.XX.COM
at org.apache.hadoop.security.UserGroupInformation$HadoopLoginModule.commit(UserGroupInformation.java:199)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at javax.security.auth.login.LoginContext.invoke(Unknown Source)
at javax.security.auth.login.LoginContext.access$000(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
at javax.security.auth.login.LoginContext.login(Unknown Source)
at org.apache.hadoop.security.UserGroupInformation.loginUserFromKeytab(UserGroupInformation.java:953)
... 2 more
Caused by: java.lang.IllegalArgumentException: Illegal principal name name#XX.XX.COM: org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No rules applied to name#XX.XX.COM
at org.apache.hadoop.security.User.<init>(User.java:51)
at org.apache.hadoop.security.User.<init>(User.java:43)
at org.apache.hadoop.security.UserGroupInformation$HadoopLoginModule.commit(UserGroupInformation.java:197)
... 14 more
Caused by: org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No rules applied to name#XX.XX.COM
at org.apache.hadoop.security.authentication.util.KerberosName.getShortName(KerberosName.java:389)
at org.apache.hadoop.security.User.<init>(User.java:48)
... 16 more
Jul 06, 2016 4:29:14 PM com.XX.it.logging.JdkMapper info
INFO: IO Exception occured: java.io.IOException: Login failure for name#XX.XX.COM from keytab \\NASdrive\name.keytab: javax.security.auth.login.LoginException: java.lang.IllegalArgumentException: Illegal principal name name#XX.XX.COM: org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule: No rules applied to name#XX.XX.COM
So issues seems to be loading the config file. My application reading the keytab file fine from NAS drive, but not the Hadoop config files. What could be the issue. I checked all the NAS Drive permissions and file permissions. Everthing is fine. I dont know where the issue is. please anyone help me to find out the issue.
You're missing "DEFAULT" rule for auth_to_local kerberos principal name transformation.
org.apache.hadoop.security.authentication.util.KerberosName$NoMatchingRule:
No rules applied to
See example here -
https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/SecureMode.html#Mapping_from_Kerberos_principals_to_OS_user_accounts
so basically just add word "DEFAULT" at the very end of hadoop.security.auth_to_local in your core-site.xml.
Also check auth_to_local in Kerberos documentation .
PS. Here's where this exception happens in Hadoop codebase, in case if you're interested to dig deeper on this subject.

WAS8.5.5 not incorporating Jacorb application

I had an application which is tightly coupled with jacorb and it is working great with Jboss. Now, i have to migrate this application to deploy the same in Websphere 8.5.5. General flow is , my application will reach another system (developed in C++) through corba usign jacorb. since IBM is having its own ORB implementations, My application is getting deployed in websphere. If my application is modified to make use of IBM orb jars, then 80% of applciation have to change. Kindly suggest me the way to include jacord proeprties and jar to resolve the errors.
My trails : All trails are independent to each other.
1) Kept my orb.properties, jacorb.jar and removed IBM orb.properties in WAS->JAVA->JRE->lib
2) Included my files in JVM classpath through Admin console.(Server failed to start after this change).
3) Modified the IBM orb.properties with jacorb properties but getting classcast exceptions.
Errors:
[3/4/15 0:52:23:175 PST] 00000001 ContainerHelp E WSVR0501E: Error creating component null [class com.ibm.ws.runtime.component.ORBImpl]java.lang.NullPointerException
at java.util.Hashtable.put(Hashtable.java:877)
at org.jacorb.config.JacORBConfiguration.setAttribute(Unknown Source)
at org.jacorb.config.JacORBConfiguration.setAttributes(Unknown Source)
at org.jacorb.config.JacORBConfiguration.init(Unknown Source)
at org.jacorb.config.JacORBConfiguration.<init>(Unknown Source)
at org.jacorb.config.JacORBConfiguration.getConfiguration(Unknown Source)
at org.jacorb.orb.ORB.set_parameters(Unknown Source)
at org.omg.CORBA.ORB.init(ORB.java:371)
at com.ibm.ws.orb.GlobalORBFactory.init(GlobalORBFactory.java:92)
[3/4/15 0:52:23:347 PST] 00000001 ContainerHelp E WSVR0501E: Error creating component com.ibm.ws.naming.bootstrap.NameServerImpl#e69374e2[_serverProcessType=UnManagedProcess, _listener=null,
Caused by: javax.naming.NamingException: Failed to initialize the ORB [Root exception is java.lang.reflect.InvocationTargetException]
at com.ibm.ws.naming.util.Helpers.getOrb(Helpers.java:400)
at com.ibm.ws.naming.urlbase.UrlContextImpl.<init>(UrlContextImpl.java:177)
at com.ibm.ws.naming.urlns.genericURLContext.<init>(genericURLContext.java:83)
at com.ibm.ws.naming.urlns.genericURLContextRoot.<init>(genericURLContextRoot.java:79)
at com.ibm.ws.naming.urlns.genericURLContextFactory.createURLContextRoot(genericURLContextFactory.java:110)
... 51 more
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:60)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:37)
at java.lang.reflect.Method.invoke(Method.java:611)
at com.ibm.ws.naming.util.Helpers.getOrb(Helpers.java:391)
... 55 more
Caused by: java.lang.ClassCastException: org.jacorb.orb.ORB incompatible with com.ibm.CORBA.iiop.ORB
at com.ibm.ws.orb.GlobalORBFactory.init(GlobalORBFactory.java:92)
at com.ibm.ejs.oa.EJSORBImpl.initializeORB(EJSORBImpl.java:179)
at com.ibm.ejs.oa.EJSClientORBImpl.<init>(EJSClientORBImpl.java:83)
at
Thanks for your support in advance.

Categories