SASL handshake: wrong Token ID. Expected 0504, was 6030

[donalhunt]

This appears to be similar to issues #144, #145 and #209.

The existing travis-ci test seems to only test the scenario where CDH is configured with both authentication and transfer encryption enabled. In my case authentication is enabled but transfer encryption is disabled.

$ ./hdfs ls /
Couldn't connect to namenode: no available namenodes: SASL handshake: wrong Token ID. Expected 0504, was 

Environment: Cloudera Enterprise 6.3.4
Java version: Java Version: 1.8.0_302

Redacted versions of core-site.xml hdfs-site.xml are attached.

hdfs-site.xml.txt
core-site.xml.txt

[donalhunt]

I dug into this issue in detail this morning...

In summary, I suspect the issue is that the environment is using rc4-hmac as the encryption type for kerberos tickets.
hdfs relies on a golang kerberos library (github.com/jcmturner/gokrb5 which claims to support rc4-hmac but comment IBM/sarama#1366 (comment) seems to raise doubts.

I suspect that if there is an issue, it's upstream of hdfs or specific to the environment (but others have encountered the same error so documenting for prosperity). Any pointers appreciated.

p.s. rc4-hmac is "deprecated" with aes128-cts-hmac-sha1-96 / aes256-cts-hmac-sha1-96 being recommended as suitable replacements. Will attempt switching the environment to aes256-cts-hmac-sha1-96 and see if it makes any difference. :)

[colinmarc]

Hi @donalhunt,

Going to close this, but please chime in with any updates.