PXF query report error "Unable to obtain password from user"

Products

• VMware Tanzu Greenplum

Issue/Introduction

When use PXF with Kerberos, the query may fail with error:

java.lang.RuntimeException: PXF service login failed for server newhadoop : Login failure for user: xxx/xxx from keytab ${PXF_BASE}/keytabs/pxf.service.keytab javax.security.auth.login.LoginException: Unable to obtain password from user

        at org.greenplum.pxf.api.security.SecureLogin.login(SecureLogin.java:182) ~[pxf-api-6.3.0.jar!/:?]
        at org.greenplum.pxf.api.security.SecureLogin.getLoginUser(SecureLogin.java:118) ~[pxf-api-6.3.0.jar!/:?]
        at org.greenplum.pxf.service.security.BaseSecurityService.doAs(BaseSecurityService.java:77) ~[classes!/:6.3.0]
        at org.greenplum.pxf.service.controller.BaseServiceImpl.processData(BaseServiceImpl.java:74) ~[classes!/:6.3.0]
        at org.greenplum.pxf.service.controller.ReadServiceImpl.lambda$readData$1(ReadServiceImpl.java:58) ~[classes!/:6.3.0]
        at org.greenplum.pxf.service.controller.PxfErrorReporter.invokeWithErrorHandling(PxfErrorReporter.java:26) ~[classes!/:6.3.0]
        at org.greenplum.pxf.service.controller.ReadServiceImpl.readData(ReadServiceImpl.java:58) ~[classes!/:6.3.0]
        at org.greenplum.pxf.service.rest.PxfReadResource.lambda$produceResponse$0(PxfReadResource.java:53) ~[classes!/:6.3.0]
        at org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBodyReturnValueHandler$StreamingResponseBodyTask.call(StreamingResponseBodyReturnValueHandler.java:111) ~[spring-webmvc-5.3.4.jar!/:5.3.4]
        at org.springframework.web.servlet.mvc.method.annotation.StreamingResponseBodyReturnValueHandler$StreamingResponseBodyTask.call(StreamingResponseBodyReturnValueHandler.java:98) ~[spring-webmvc-5.3.4.jar!/:5.3.4]
        at org.springframework.web.context.request.async.WebAsyncManager.lambda$startCallableProcessing$4(WebAsyncManager.java:337) ~[spring-web-5.3.4.jar!/:5.3.4]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) ~[?:?]
        at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]
        at org.greenplum.pxf.service.spring.PxfContextMdcLogEnhancerDecorator.lambda$decorate$0(PxfContextMdcLogEnhancerDecorator.java:27) ~[classes!/:6.3.0]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
        at java.lang.Thread.run(Thread.java:834) [?:?]
Caused by: org.apache.hadoop.security.KerberosAuthException: Login failure for user: gpadmin/xxxx from keytab ${PXF_BASE}/keytabs/pxf.service.keytab javax.security.auth.login.LoginException: Unable to obtain password from user

Resolution

This is a general error, could be caused by many factors. Some possible place we can check first are:

• make sure pxf-env.sh does not have the Kerberos related setting.
• put all Kerberos related setting in pxf-site.xml
• make sure the pxf-site.xml does not have other settings, like hive or other hadoop setting.  
• remove pxf.service.user.name setting from pxf-site.xml,  
• set pxf.service.user.impersonation to false in pxf-site.xml
• use absolute path in pxf-site.xml instead of $PXF_BASE.