4

I've setup MongoDB enterprise on CentOS 7 with Kerberos support. Additionally I've setup a Kerberos service on CentOS 7 for the authentication. I know that Kerberos is setup correctly as I now have multiple CentOS 7 clients SSH authenticating against kerberos. When I start MongoDB with Kerberos, I get the following error in the MongoDB Enterprise logs.

2016-04-05T16:30:50.515-0500 F CONTROL  [main] Failed global initialization:
UnknownError: gssapi could not acquire server credential for 
mongodb/[email protected]; Major code 851968; Unspecified GSS failure.
Minor code may provide more information; Minor code 39756033; No key table entry 
found for mongodb/[email protected];

I've also verified that a ticket has been generated via kinit

[root@mongodb mongodb]# kinit mongodb/[email protected]
Password for mongodb/[email protected]: 
[root@mongodb mongodb]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: mongodb/[email protected]

Valid starting     Expires            Service principal
05/04/16 17:17:11  06/04/16 03:17:11  krbtgt/[email protected]
    renew until 06/04/16 17:17:09

I then verified the principals exist on both client and server

[root@mongodb mongodb]# kadmin -p root/admin
Authenticating as principal root/admin with password.
Password for root/[email protected]: 
kadmin:  listprincs
K/[email protected]
...other principals
mongodb/[email protected]
mongodb/[email protected]
root/[email protected]

What is preventing mongo to see and use this principal? I've verified my DNS is working correctly and all other Kerberos functionality seems to be working as expected. I'm unbelievably stumped with something that seems like it should be a simple fix.

1 Answer 1

2

I think that you missed one step. You should add an entry into the keytab file for your principal mongodb/[email protected]

Suppose that the path for your keytab file is /etc/krb5.keytab. Now run $ktutil

ktutil: add_entry -password -p mongodb/[email protected] -k 1 -e des-cbc-md4
ktuitl: wkt /etc/krb5.keytab 
ktuitl: quit

Now you can run $klist -k /etc/krb5.keytab
and the new entry should appear on the output.

Now, I think you can start mongod service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.