renew ticket failed

[Dong Ye]

Hi, All:


we encountered an issue where we can't renew the ticket before the
ticket expires. Seems the ticket is renewable but its renew_till time is
before its end_time. How is it possible? How to fix that. The relevant logs
are :


WARN | 27 Sep 2023 12:59:52,009 |

org.apache.hadoop.security.UserGroupInformation | Exception encountered
while running the renewal command for
org.apache.hadoop.util.Shell$ExitCodeException: kinit: Ticket expired
while renewing credentials
at org.apache.hadoop.util.Shell.runCommand(Shell.java:998)
~[hadoop-common-2.10.1-amzn-4.jar:?]
at org.apache.hadoop.util.Shell.run(Shell.java:884)
~[hadoop-common-2.10.1-amzn-4.jar:?]
at
org.apache.hadoop.util.Shell$ShellCommandExecutor.execute(Shell.java:1216)
~[hadoop-common-2.10.1-amzn-4.jar:?]
at org.apache.hadoop.util.Shell.execCommand(Shell.java:1310)
~[hadoop-common-2.10.1-amzn-4.jar:?]
at org.apache.hadoop.util.Shell.execCommand(Shell.java:1292)
~[hadoop-common-2.10.1-amzn-4.jar:?]
at
org.apache.hadoop.security.UserGroupInformation$1.run(UserGroupInformation.java:1003)
[hadoop-common-2.10.1-amzn-4.jar:?]
at java.lang.Thread.run(Thread.java:750) [?:1.8.0_382]

Note the TGT end time 1695825352000 is 27 September 2023 14:35:52 which is
in the future of the logging time 27 Sep 2023 12:59:52,009.

Thanks.

Have a nice day.

[Greg Hudson]

Post by Dong Ye
we encountered an issue where we can't renew the ticket before the
ticket expires. Seems the ticket is renewable but its renew_till time is
before its end_time. How is it possible?

It's possible if the ticket was requested that way ("kinit -l 2h -r 1h"
for instance). For a period of time (1.12 through 1.15) the MIT krb5
KDC issued non-renewable tickets for such requests, but that was found
to be disruptive to scripts, so it once again issues renewable tickets
whose end times can't be extended.