kinit: Client's credentials have been revoked while getting initial credentials

Question

I have hdp cluster configured with kerberos with AD. All HDP service accounts have principals and keytabs generated including spark.

I know service accounts will not have passwords and set to unexpire. Now while doing kinit -kt spark.keytab -p spark-PRINCIPAL I get the following error (see the title).

I read in MIT website it happens due to many unsuccessful login attempts or account expiry set in default policy in KDC.account can be unlocked using kadmin commands such as kadmin:modprinci spark/principal but I have cross checked with AD admin. He says we don't use kdc server to execute kadmin commands where as we use AD but says spark account is unlocked state when checked using AD UI.

My questions:

Is there any commands to unlock spark account in AD?

I have tired removing spark service and re install in my cluster which did regenerate new keytab or principal to avoid revoked error from AD. Saw if any spark local account causing this error.

AD admin has given me server details and password with limited privileges to do ldap search and delete commands. Can I use these privileges to unlock spark? And how to do this?

Solution 1

Issue: kinit clients credentials have been revoked while getting initial credentials

The solution is very simple. Check the WMI account in active directory. The WMI or WMI_query account must have been locked out. Which triggers this error on.

Solution: unlock the WMI_query account in active directory. Refresh it few times. Issue resolved. Thanks Hamid Bhalli

Solution 2

Sometimes you might get this error when your user password has changed. It happened to me & first result from google brought me to this page but above solution didn't work.

Solution: Run

kdestroy

followed by

kinit

Solution 3

The error you presented: "kinit: Clients credentials have been revoked while getting initial credentials" means the Active Directory account to which the keytab is related has been disabled, locked, expired, or deleted.

By default, one cannot unlock their own account in AD (unless they are Domain Administrator, Domain Account Operator, or a member of some other administratively privileged group). The AD admin would need to grant you these rights. Based on the problem description, it sounds entirely possible the AD admin is looking at the wrong account. For example if you run the command:

setspn -Q HTTP/somedomain.local

where "HTTP/somedomain.local" represents the SPN in this case, the output will reveal the name of the AD account tied to the SPN and keytab - your AD admin needs to look at that account and determine whether its been disabled, locked, expired, or deleted and take corrective action.

Comments

[Ravi OpenSource]

How to find the wmi account in active directory

[tomh]

This answer has the benefit of the user being able to fix the issue on their own.