How To Solve Issues Related to Log – Hadoop authentication method is set to [SIMPLE]; but a Kerberos principal is

Get an Elasticsearch Check-Up


Check if your ES issues are caused from misconfigured settings
(Free 2 min process)

ES Check Up
Elasticsearch Error Guide In Page Navigation :

Troubleshooting Background – start here to get the full picture       
Related Issues – selected resources on related issues  
Log Context – usefull for experts
About Opster – offering a diffrent approach to troubleshoot Elasticsearch

Check My Elasticsearch 


Troubleshooting background

To troubleshoot Elasticsearch log “Hadoop authentication method is set to [SIMPLE]; but a Kerberos principal is” it’s important to know common problems related to Elasticsearch concepts: plugins, repositories, repository-azure. See below-detailed explanations complete with common problems, examples and useful tips.

Plugin in Elasticsearch

What it is

Plugins are used to extend the functionality of Elasticsearch. In addition to the core plugins available to you, it is possible to write custom plugins as well. Plugins are generated in a zip format with the mandatory file structure.

Examples:
  • Core Plugins: Xpack for Security and monitoring, Discovery plugins for EC2
  • Adding S3 plugin for storing snapshots on S3
sudo bin/elasticsearch-plugin install repository-s3
  • Adding HDFS plugin for storing snapshots on HDFS
sudo bin/elasticsearch-plugin install repository-hdfs
  • Removing a plugin
sudo bin/elasticsearch-plugin remove repository-hdfs
Notes:
  • Plugins are installed using the Elasticsearch-plugin script, which enables actions such as  listing, removing and installing plugins.
  • Core plugins can be installed simply by providing the name of the plugin to the Elasticsearch-plugin command.
  • You can also download the plugin manually and then install it using the elasticsearch-plugin install command, providing the file name/path of the plugin’s source file.
  • When a plugin is removed, you will need to restart the elasticsearch node(s) in order to complete the removal process.
Common Problems:
  • You need to install the required plugins in your Elasticsearch deployment before moving it to production machines. (as it’s likely your production machines are behind a proxy and it’s very hard to get plugins installed behind a proxy).
  • The same is true when you are going to deploy elasticsearch using Docker images, you will most likely be rebuilding the standard image and including your required plugins in the custom docker build. Make sure the docker build is run on a build machine that is not behind a proxy, otherwise the plugin installation will fail during docker build.

Click here to get to our list of the Most frequent issues caused by Elasticsearch Plugins

Repositories/Repository in Elasticsearch

What it is

An Elasticsearch snapshot provides a backup mechanism that takes the current state and data in the cluster and saves it to a repository (read the Glossary term Snapshot for more information). The backup process requires a repository to be created first. The repository needs to be registered using the _snapshot endpoint, and multiple repositories per cluster can be created. The following repository types are supported. 

Repository Types:
Repository TypeConfiguration Type
Shared file systemType: “fs”
S3Type : “s3”
HDFSType :“hdfs”
AzureType: “azure”
Google Cloud StorageType : “gcs”
Examples

To register a repository of type fs:

PUT _snapshot/my_repo_01
{
"type": "fs",
"settings": {
"location": "/mnt/my_repo_dir"
  }
}
Notes and common problems
  • S3, HDFS , Azure and Google Cloud requires a relevant plugin to be installed before it can be used for a snapshot.
  • The setting, path.repo: /mnt/my_repo_dir needs to be added to elasticsearch.yml on all the nodes in case you are planning to use repo type of file system otherwise it will fail
  • In case of using remote repositories , the network bandwidth and repository storage throughput should be high enough to complete the snapshot operations normally , otherwise you will end up in partial snapshots.


To help troubleshoot related issues we have gathered selected Q&A from the community and issues from Github , please review the following for further information :

Common Protection Layer Between Cl
stackoverflow.com/questions/37714669/no-common-protection-layer-between-client-and-server-while-trying-to-communica

 

Ipping Kerberos Authentication Prom
stackoverflow.com/questions/29669459/skipping-kerberos-authentication-prompts-with-jsch/29692245

 


Log Context

Log ”Hadoop authentication method is set to [SIMPLE]; but a Kerberos principal is” classname is HdfsRepository.java
We have extracted the following from Elasticsearch source code to get an in-depth context :

         // Check if the user added a principal to use; and that there is a keytab file provided
        String kerberosPrincipal = repositorySettings.get(CONF_SECURITY_PRINCIPAL);

        // Check to see if the authentication method is compatible
        if (kerberosPrincipal != null && authMethod.equals(AuthenticationMethod.SIMPLE)) {
            logger.warn("Hadoop authentication method is set to [SIMPLE]; but a Kerberos principal is " +
                "specified. Continuing with [KERBEROS] authentication.");
            SecurityUtil.setAuthenticationMethod(AuthenticationMethod.KERBEROS; hadoopConfiguration);
        } else if (kerberosPrincipal == null && authMethod.equals(AuthenticationMethod.KERBEROS)) {
            throw new RuntimeException("HDFS Repository does not support [KERBEROS] authentication without " +
                "a valid Kerberos principal and keytab. Please specify a principal in the repository settings with [" +






About Opster

Incorporating deep knowledge and broad history of Elasticsearch issues. Opster’s solution identifies and predicts root causes of Elasticsearch problems, provides recommendations and can automatically perform various actions to manage, troubleshoot and prevent issues

We are constantly updating our analysis of Elasticsearch logs, errors, and exceptions. Sharing best practices and providing troubleshooting guides.

Learn more: Glossary | Blog| Troubleshooting guides | Error Repository

Need help with any Elasticsearch issue ? Contact Opster

Did this page help you?