PXF with kerberos reports error "message stream modified (41)”

Products

• VMware Tanzu Greenplum

Issue/Introduction

When a PXF service is configured with Kerberos enabled, sometimes the query for PXF external table will report error :

message stream modified (41)”

Resolution

Resolution

A general solution is to remove "renew_lifetime = xxx" setting from /etc/krb5.conf file, then restart PXF service.

Cause

When the "renew_lifetime = xxx" setting is set in Kerberos client, Java runtime will automatically set "kdcOptions renewable=true".  If this setting at the Kerberos server side set to false, then it will trigger the error.

This behaviour starts from Java version jre-8u242 and later releases.