Should Kerberos cache file remain empty after successful authentication? - kerberos

Question

I'm struggling with connecting to Impala which is part of a kerberised CDH cluster via JDBC driver. For authentication I need to acquire a Kerberos ticket on my machine. kinit works like a charm. The strange is that, when I setup KRB5CCNAME variable pointing to a file the file remains empty after successful authentication, but klist shows that I'm authenticated. Is it the expected behaviour?
The reason I ask this is that, my java app can't connect to Impala and the error message suggest that the empty file could be the problem. However, a python script can connect to the same Impala from the same machine.
It is a Mac 2018.

Answer 1

It shouldn't.
Apple has its own bundled kerberos implementation (Heimdal) which does this strange empty file thing.
I installed krb5 package from brew, modified the PATH accordingly and it works fine.
myself#mymachine:~$ brew info krb5
krb5: stable 1.16.2 (bottled) [keg-only]
Network authentication protocol
https://web.mit.edu/kerberos/
/usr/local/Cellar/krb5/1.16.2 (160 files, 3.7MB)
Poured from bottle on 2018-12-18 at 15:20:46
From: https://github.com/Homebrew/homebrew-core/blob/master/Formula/krb5.rb
==> Dependencies
Required: openssl ✔
==> Caveats
krb5 is keg-only, which means it was not symlinked into /usr/local,
because macOS already provides this software and installing another version in
parallel can cause all kinds of trouble.
If you need to have krb5 first in your PATH run:
echo 'export PATH="/usr/local/opt/krb5/bin:$PATH"' >> ~/.bash_profile
echo 'export PATH="/usr/local/opt/krb5/sbin:$PATH"' >> ~/.bash_profile
For compilers to find krb5 you may need to set:
export LDFLAGS="-L/usr/local/opt/krb5/lib"
export CPPFLAGS="-I/usr/local/opt/krb5/include"
For pkg-config to find krb5 you may need to set:
export PKG_CONFIG_PATH="/usr/local/opt/krb5/lib/pkgconfig"
==> Analytics
install: 198 (30 days), 614 (90 days), 1,986 (365 days)
install_on_request: 182 (30 days), 557 (90 days), 1,768 (365 days)
build_error: 0 (30 days)
myself#mymachine:~$ /usr/bin/klist --version
klist (Heimdal 1.5.1apple1)
Copyright 1995-2011 Kungliga Tekniska Högskolan
Send bug-reports to heimdal-bugs#h5l.org
Similar issue will arise on Windows, where Kerberos does not respect whether KRB5CCNAME environment variable is set or not. The solution for this is using older version. This page mentions 4.0.1 version, however on the Kerberos page you can find 4.1. The first will use file cache, the latter will use API and pretty difficult to ask it not to use it.