ipc.Client: Couldn't setup connection for scm/scm@EXAMPLE.COM to 192.168.69.101/192.168.69.101:9862

[dyrnq]

hdfs dfs -ls ofs://o101

2025-10-13 12:12:50,240 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:12:53,666 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:12:57,510 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:02,170 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:06,741 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:08,438 WARN ipc.Client: Couldn't setup connection for scm/scm@EXAMPLE.COM to 192.168.69.101/192.168.69.101:9862
org.apache.hadoop.ipc.RemoteException(javax.security.sasl.SaslException): Failure to initialize security context
        at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:383)
        at org.apache.hadoop.ipc.Client$Connection.setupSaslConnection(Client.java:578)
        at org.apache.hadoop.ipc.Client$Connection.access$2100(Client.java:364)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:799)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:795)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:714)
        at java.base/javax.security.auth.Subject.doAs(Subject.java:525)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1953)
        at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:795)
        at org.apache.hadoop.ipc.Client$Connection.access$3800(Client.java:364)
        at org.apache.hadoop.ipc.Client.getConnection(Client.java:1649)
        at org.apache.hadoop.ipc.Client.call(Client.java:1473)
        at org.apache.hadoop.ipc.Client.call(Client.java:1426)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:250)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:132)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:437)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:170)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:162)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:100)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:366)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at org.apache.hadoop.ozone.om.protocolPB.Hadoop3OmTransport.submitRequest(Hadoop3OmTransport.java:73)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.submitRequest(OzoneManagerProtocolClientSideTranslatorPB.java:340)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.getServiceInfo(OzoneManagerProtocolClientSideTranslatorPB.java:1880)
        at org.apache.hadoop.ozone.client.rpc.RpcClient.<init>(RpcClient.java:260)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:264)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:247)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getRpcClient(OzoneClientFactory.java:110)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneClientAdapterImpl.<init>(BasicRootedOzoneClientAdapterImpl.java:208)
        at org.apache.hadoop.fs.ozone.RootedOzoneClientAdapterImpl.<init>(RootedOzoneClientAdapterImpl.java:50)
        at org.apache.hadoop.fs.ozone.RootedOzoneFileSystem.createAdapter(RootedOzoneFileSystem.java:106)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneFileSystem.initialize(BasicRootedOzoneFileSystem.java:194)
        at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3615)
        at org.apache.hadoop.fs.FileSystem.access$300(FileSystem.java:172)
        at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3716)
        at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3667)
        at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:557)
        at org.apache.hadoop.fs.Path.getFileSystem(Path.java:366)
        at org.apache.hadoop.fs.shell.PathData.expandAsGlob(PathData.java:347)
        at org.apache.hadoop.fs.shell.Command.expandArgument(Command.java:265)
        at org.apache.hadoop.fs.shell.Command.expandArguments(Command.java:248)
        at org.apache.hadoop.fs.shell.FsCommand.processRawArguments(FsCommand.java:105)
        at org.apache.hadoop.fs.shell.Command.run(Command.java:192)
        at org.apache.hadoop.fs.FsShell.run(FsShell.java:327)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:82)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:97)
        at org.apache.hadoop.fs.FsShell.main(FsShell.java:390)
2025-10-13 12:13:10,500 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:12,365 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:16,483 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:20,608 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:20,982 WARN security.UserGroupInformation: Not attempting to re-login since the last re-login was attempted less than 60 seconds before. Last Login=1760328769307
2025-10-13 12:13:25,650 WARN ipc.Client: Couldn't setup connection for scm/scm@EXAMPLE.COM to 192.168.69.101/192.168.69.101:9862
org.apache.hadoop.ipc.RemoteException(javax.security.sasl.SaslException): Failure to initialize security context
        at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:383)
        at org.apache.hadoop.ipc.Client$Connection.setupSaslConnection(Client.java:578)
        at org.apache.hadoop.ipc.Client$Connection.access$2100(Client.java:364)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:799)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:795)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:714)
        at java.base/javax.security.auth.Subject.doAs(Subject.java:525)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1953)
        at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:795)
        at org.apache.hadoop.ipc.Client$Connection.access$3800(Client.java:364)
        at org.apache.hadoop.ipc.Client.getConnection(Client.java:1649)
        at org.apache.hadoop.ipc.Client.call(Client.java:1473)
        at org.apache.hadoop.ipc.Client.call(Client.java:1426)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:250)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:132)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:437)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:170)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:162)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:100)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:366)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at org.apache.hadoop.ozone.om.protocolPB.Hadoop3OmTransport.submitRequest(Hadoop3OmTransport.java:73)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.submitRequest(OzoneManagerProtocolClientSideTranslatorPB.java:340)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.getServiceInfo(OzoneManagerProtocolClientSideTranslatorPB.java:1880)
        at org.apache.hadoop.ozone.client.rpc.RpcClient.<init>(RpcClient.java:260)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:264)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:247)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getRpcClient(OzoneClientFactory.java:110)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneClientAdapterImpl.<init>(BasicRootedOzoneClientAdapterImpl.java:208)
        at org.apache.hadoop.fs.ozone.RootedOzoneClientAdapterImpl.<init>(RootedOzoneClientAdapterImpl.java:50)
        at org.apache.hadoop.fs.ozone.RootedOzoneFileSystem.createAdapter(RootedOzoneFileSystem.java:106)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneFileSystem.initialize(BasicRootedOzoneFileSystem.java:194)
        at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3615)
        at org.apache.hadoop.fs.FileSystem.access$300(FileSystem.java:172)
        at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3716)
        at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3667)
        at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:557)
        at org.apache.hadoop.fs.Path.getFileSystem(Path.java:366)
        at org.apache.hadoop.fs.shell.PathData.expandAsGlob(PathData.java:347)
        at org.apache.hadoop.fs.shell.Command.expandArgument(Command.java:265)
        at org.apache.hadoop.fs.shell.Command.expandArguments(Command.java:248)
        at org.apache.hadoop.fs.shell.FsCommand.processRawArguments(FsCommand.java:105)
        at org.apache.hadoop.fs.shell.Command.run(Command.java:192)
        at org.apache.hadoop.fs.FsShell.run(FsShell.java:327)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:82)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:97)
        at org.apache.hadoop.fs.FsShell.main(FsShell.java:390)

[dyrnq]

vagrant@o211:/vagrant$ hdfs dfs -ls ofs://o101
2025-10-13 12:25:30,621 WARN ipc.Client: Exception encountered while connecting to the server o101/192.168.69.101:9862
org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
        at org.apache.hadoop.security.SaslRpcClient.selectSaslClient(SaslRpcClient.java:179)
        at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:399)
        at org.apache.hadoop.ipc.Client$Connection.setupSaslConnection(Client.java:578)
        at org.apache.hadoop.ipc.Client$Connection.access$2100(Client.java:364)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:799)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:795)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:714)
        at java.base/javax.security.auth.Subject.doAs(Subject.java:525)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1953)
        at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:795)
        at org.apache.hadoop.ipc.Client$Connection.access$3800(Client.java:364)
        at org.apache.hadoop.ipc.Client.getConnection(Client.java:1649)
        at org.apache.hadoop.ipc.Client.call(Client.java:1473)
        at org.apache.hadoop.ipc.Client.call(Client.java:1426)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:250)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:132)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:437)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:170)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:162)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:100)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:366)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at org.apache.hadoop.ozone.om.protocolPB.Hadoop3OmTransport.submitRequest(Hadoop3OmTransport.java:73)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.submitRequest(OzoneManagerProtocolClientSideTranslatorPB.java:340)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.getServiceInfo(OzoneManagerProtocolClientSideTranslatorPB.java:1880)
        at org.apache.hadoop.ozone.client.rpc.RpcClient.<init>(RpcClient.java:260)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:264)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:247)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getRpcClient(OzoneClientFactory.java:110)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneClientAdapterImpl.<init>(BasicRootedOzoneClientAdapterImpl.java:208)
        at org.apache.hadoop.fs.ozone.RootedOzoneClientAdapterImpl.<init>(RootedOzoneClientAdapterImpl.java:50)
        at org.apache.hadoop.fs.ozone.RootedOzoneFileSystem.createAdapter(RootedOzoneFileSystem.java:106)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneFileSystem.initialize(BasicRootedOzoneFileSystem.java:194)
        at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3615)
        at org.apache.hadoop.fs.FileSystem.access$300(FileSystem.java:172)
        at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3716)
        at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3667)
        at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:557)
        at org.apache.hadoop.fs.Path.getFileSystem(Path.java:366)
        at org.apache.hadoop.fs.shell.PathData.expandAsGlob(PathData.java:347)
        at org.apache.hadoop.fs.shell.Command.expandArgument(Command.java:265)
        at org.apache.hadoop.fs.shell.Command.expandArguments(Command.java:248)
        at org.apache.hadoop.fs.shell.FsCommand.processRawArguments(FsCommand.java:105)
        at org.apache.hadoop.fs.shell.Command.run(Command.java:192)
        at org.apache.hadoop.fs.FsShell.run(FsShell.java:327)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:82)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:97)
        at org.apache.hadoop.fs.FsShell.main(FsShell.java:390)
2025-10-13 12:25:30,630 ERROR client.OzoneClientFactory: Couldn't create RpcClient protocol exception: 
java.io.IOException: DestHost:destPort o101:9862 , LocalHost:localPort o211/127.0.2.1:0. Failed on local exception: java.io.IOException: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
        at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62)
        at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502)
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486)
        at org.apache.hadoop.net.NetUtils.wrapWithMessage(NetUtils.java:961)
        at org.apache.hadoop.net.NetUtils.wrapException(NetUtils.java:936)
        at org.apache.hadoop.ipc.Client.getRpcResponse(Client.java:1588)
        at org.apache.hadoop.ipc.Client.call(Client.java:1529)
        at org.apache.hadoop.ipc.Client.call(Client.java:1426)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:250)
        at org.apache.hadoop.ipc.ProtobufRpcEngine$Invoker.invoke(ProtobufRpcEngine.java:132)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:437)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:170)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:162)
        at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:100)
        at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:366)
        at jdk.proxy2/jdk.proxy2.$Proxy14.submitRequest(Unknown Source)
        at org.apache.hadoop.ozone.om.protocolPB.Hadoop3OmTransport.submitRequest(Hadoop3OmTransport.java:73)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.submitRequest(OzoneManagerProtocolClientSideTranslatorPB.java:340)
        at org.apache.hadoop.ozone.om.protocolPB.OzoneManagerProtocolClientSideTranslatorPB.getServiceInfo(OzoneManagerProtocolClientSideTranslatorPB.java:1880)
        at org.apache.hadoop.ozone.client.rpc.RpcClient.<init>(RpcClient.java:260)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:264)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getClientProtocol(OzoneClientFactory.java:247)
        at org.apache.hadoop.ozone.client.OzoneClientFactory.getRpcClient(OzoneClientFactory.java:110)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneClientAdapterImpl.<init>(BasicRootedOzoneClientAdapterImpl.java:208)
        at org.apache.hadoop.fs.ozone.RootedOzoneClientAdapterImpl.<init>(RootedOzoneClientAdapterImpl.java:50)
        at org.apache.hadoop.fs.ozone.RootedOzoneFileSystem.createAdapter(RootedOzoneFileSystem.java:106)
        at org.apache.hadoop.fs.ozone.BasicRootedOzoneFileSystem.initialize(BasicRootedOzoneFileSystem.java:194)
        at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3615)
        at org.apache.hadoop.fs.FileSystem.access$300(FileSystem.java:172)
        at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3716)
        at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3667)
        at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:557)
        at org.apache.hadoop.fs.Path.getFileSystem(Path.java:366)
        at org.apache.hadoop.fs.shell.PathData.expandAsGlob(PathData.java:347)
        at org.apache.hadoop.fs.shell.Command.expandArgument(Command.java:265)
        at org.apache.hadoop.fs.shell.Command.expandArguments(Command.java:248)
        at org.apache.hadoop.fs.shell.FsCommand.processRawArguments(FsCommand.java:105)
        at org.apache.hadoop.fs.shell.Command.run(Command.java:192)
        at org.apache.hadoop.fs.FsShell.run(FsShell.java:327)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:82)
        at org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:97)
        at org.apache.hadoop.fs.FsShell.main(FsShell.java:390)
Caused by: java.io.IOException: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
        at org.apache.hadoop.ipc.Client$Connection$1.run(Client.java:754)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:714)
        at java.base/javax.security.auth.Subject.doAs(Subject.java:525)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1953)
        at org.apache.hadoop.ipc.Client$Connection.handleSaslConnectionFailure(Client.java:709)
        at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:812)
        at org.apache.hadoop.ipc.Client$Connection.access$3800(Client.java:364)
        at org.apache.hadoop.ipc.Client.getConnection(Client.java:1649)
        at org.apache.hadoop.ipc.Client.call(Client.java:1473)
        ... 38 more
Caused by: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
        at org.apache.hadoop.security.SaslRpcClient.selectSaslClient(SaslRpcClient.java:179)
        at org.apache.hadoop.security.SaslRpcClient.saslConnect(SaslRpcClient.java:399)
        at org.apache.hadoop.ipc.Client$Connection.setupSaslConnection(Client.java:578)
        at org.apache.hadoop.ipc.Client$Connection.access$2100(Client.java:364)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:799)
        at org.apache.hadoop.ipc.Client$Connection$2.run(Client.java:795)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:714)
        at java.base/javax.security.auth.Subject.doAs(Subject.java:525)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1953)
        at org.apache.hadoop.ipc.Client$Connection.setupIOstreams(Client.java:795)
        ... 41 more
2025-10-13 12:25:30,633 WARN fs.FileSystem: Failed to initialize filesystem ofs://o101: java.io.IOException: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]
ls: org.apache.hadoop.security.AccessControlException: Client cannot authenticate via:[TOKEN, KERBEROS]

[dyrnq]

klist 输出说明当前进程拥有的 Kerberos 凭证如下：

项目	内容
Ticket cache	FILE:/tmp/krb5cc_1002（本地文件）
Default principal	om/om@EXAMPLE.COM
Ticket	krbtgt/EXAMPLE.COM@EXAMPLE.COM（TGT），有效期 10/16 15:20 → 10/17 03:20，可续期至 10/23 15:20

为什么仍然出现 “Auth failed … Failure to initialize security context”

1. 使用的 principal 与服务不匹配

   • Ozone/OM 的 RPC 端口（9862）在 Kerberos 中通常要求 host‑type principal，形如 om/hostname@REALM 或 host/hostname@REALM。
   • 你当前拥有的默认 principal 是 om/om@EXAMPLE.COM，这只适用于 用户/服务 om，而不是 机器名 om1、om3 等。
   • 当客户端尝试用 om/om@EXAMPLE.COM 去访问 om1（或 om3）的服务时，KDC 找不到对应的 host principal，于是返回 “Failure to initialize security context”。

2. 主机名解析不一致

   • 如果机器的 FQDN 为 om1.example.com，但 Kerberos principal 为 om/om@EXAMPLE.COM，KDC 会认为请求的服务 principal 与实际主机不匹配。
   • 检查 hostname -f 与 krb5.conf 中的 [realms]、[domain_realm] 映射是否一致。

3. 缺少对应的 keytab

   • 对于服务端（OM）需要一个 keytab，其中必须包含 host principal（如 om1/om1.example.com@EXAMPLE.COM）的密钥。
   • 若只放置了 om/om@EXAMPLE.COM 的 keytab，服务端在启动时无法用它来完成 GSS‑API 握手。

4. 时间同步

   • 虽然 TGT 看起来有效，但如果 om1/om3 与 KDC 的系统时间相差 >5 分钟，Kerberos 仍会报错。确保所有节点使用 NTP/chrony 同步。

解决步骤

步骤	操作
1. 确认主机名	hostname -f → 记下完整 FQDN（如 om1.example.com）。
2. 创建/检查 host principal	bash<br>kadmin.local -q "addprinc -randkey host/om1.example.com@EXAMPLE.COM"<br>kadmin.local -q "ktadd -k /etc/om.keytab host/om1.example.com@EXAMPLE.COM"<br>（对每台 OM 节点重复）。
3. 使用正确的 keytab 启动服务	在 Ozone/OM 启动脚本中指定 -Djava.security.krb5.conf=/etc/krb5.conf -Djava.security.auth.login.config=/etc/om_jaas.conf -Djava.security.keyStore=/etc/om.keytab（具体参数视部署而定）。
4. 重新获取 ticket（如果使用用户 principal）	bash<br>kinit -kt /etc/om.keytab host/om1.example.com@EXAMPLE.COM<br>klist # 确认出现 host principal<br>
5. 验证网络/时间	bash<br>chronyc tracking # 确认时钟同步<br>nc -vz <kdc-host> 88 # 检查到 KDC 的连通性<br>
6. 重启 Ozone/OM	确认日志中不再出现 Auth failed … Failure to initialize security context。

完成上述步骤后，客户端（192.168.69.211）在连接 OM 的 9862 端口时就能成功完成 Kerberos 认证，日志中的 Auth failed 将消失，Raft 同步也会恢复正常。