panwu created RANGER-3138:
-----------------------------
Summary: RangerAdminRESTClient: Error getting policies, 401
Key: RANGER-3138
URL: https://issues.apache.org/jira/browse/RANGER-3138
Project: Ranger
Issue Type: Bug
Components: admin, plugins, Ranger
Affects Versions: 2.0.0
Reporter: panwu
I have Ranger 2.0, and Hadoop cluster with Kerberos.
When I enable HDFS plugin, in HDFS name node's log:
{code:java}
RangerAdminRESTClient: Error getting policies. secureMode=true,
user=nn/[email protected] (auth:KERBEROS),
response={"httpStatusCode":401,"statusCode":0}, serviceName=hadoop
{code}
I was config the `hadoop.security.auth_to_local` both Hadoop's core-site.xml
and Ranger's server manager.
I saw the same issue `RANGER-2621` with getting policies to fail, and the
response code is 401. Maybe that caused by IP in Kerberos principal but I am
not.
hdfs-site.xml (only some name node configs)
{code:java}
dfs.namenode.kerberos.principal=nn/[email protected]
dfs.namenode.keytab.file=/etc/kerberos/hadoop/nn.bdp-05.keytab
[email protected]
dfs.web.authentication.kerberos.keytab=/etc/kerberos/hadoop/http.keytab
{code}
Ranger admin's install.properties (kerberos config)
{code:java}
[email protected]
spnego_keytab=/etc/kerberos/ranger/rangerhttp.keytab
token_valid=30
cookie_domain=
cookie_path=/
admin_principal=rangeradmin/[email protected]
admin_keytab=/etc/kerberos/ranger/rangeradmin.bdp-05.keytab
lookup_principal=rangerlookup/[email protected]
lookup_keytab=/etc/kerberos/ranger/rangerlookup.bdp-05.keytab
hadoop_conf=/data/bd-components/hadoop-3.1.3/etc/hadoop/{code}
Ranger-hdfs's install.properties
{code:java}
POLICY_MGR_URL=http://bigdata-server-05:6080
REPOSITORY_NAME=hadoop
CUSTOM_USER=hdfs
CUSTOM_GROUP=hadoop
{code}
HDFS service on Ranger web UI:
{code:java}
Service Name: hadoop
Username: hdfs
password: any
Namenode URL: hdfs://bigdata-server-05:9820
Authorization Enabled: true
Authentication Type: kerberos
hadoop.security.auth_to_local: RULE:[2:$1/$2@$0]([nds]n/.*@BDP\.COM)s/.*/hdfs/
RULE:[2:$1/$2@$0]([rn]m/.*@BDP\.COM)s/.*/yarn/
RULE:[2:$1/$2@$0](jhs/.*@BDP\.COM)s/.*/mapred/
dfs.datanode.kerberos.principal: dn/[email protected]
dfs.namenode.kerberos.principal: nn/[email protected]
dfs.secondary.namenode.kerberos.principa: sn/[email protected]
RPC Protection Type: authentication
tag.download.auth.users: hdfs
policy.download.auth.users: hdfs{code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
