https://community.cloudera.com/t5/Support-Questions/Knox-Response-status-401/m-p/231771#M193614 <P>Hi all</P><P>I am trying figure out knox gateway</P><P>but I have problem when I access services like WEBHDFS</P><P>this is error log from /var/log/knox/gateway-audit.log:</P><PRE>17/12/28 21:30:30 ||de5c4e70-c89c-487e-8fea-6260c6701efb|audit|IPADDR|WEBHDFS||||access|uri|/gateway/default/webhdfs/v1|unavailable|Request method: GET 17/12/28 21:30:30 ||de5c4e70-c89c-487e-8fea-6260c6701efb|audit|IPADDR|WEBHDFS||||access|uri|/gateway/default/webhdfs/v1|success|Response status: 401 </PRE><P>this is my topology configuration:</P><PRE> &lt;topology&gt; &lt;gateway&gt; &lt;provider&gt; &lt;role&gt;authentication&lt;/role&gt; &lt;name&gt;ShiroProvider&lt;/name&gt; &lt;enabled&gt;true&lt;/enabled&gt; &lt;param&gt; &lt;name&gt;sessionTimeout&lt;/name&gt; &lt;value&gt;15&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm&lt;/name&gt; &lt;value&gt;org.apache.hadoop.gateway.shirorealm.KnoxLdapRealm&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapContextFactory&lt;/name&gt; &lt;value&gt;org.apache.hadoop.gateway.shirorealm.KnoxLdapContextFactory&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.contextFactory&lt;/name&gt; &lt;value&gt;$ldapContextFactory&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.contextFactory.url&lt;/name&gt; &lt;value&gt;ldap://ragaca.com:389&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.authorizationEnabled&lt;/name&gt; &lt;value&gt;true&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.contextFactory.authenticationMechanism&lt;/name&gt; &lt;value&gt;simple&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.userDnTemplate&lt;/name&gt; &lt;value&gt;sAMAccountName={0}&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.userSearchAttributeName&lt;/name&gt; &lt;value&gt;sAMAccountName&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.userObjectClass&lt;/name&gt; &lt;value&gt;person&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.contextFactory.systemUsername&lt;/name&gt; &lt;value&gt;CN=testUser,OU=testUsers,DC=ragaca,DC=com&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.contextFactory.systemPassword&lt;/name&gt; &lt;value&gt;*********&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.searchBase&lt;/name&gt; &lt;value&gt;OU=Domain Users &amp; Groups,DC=ragaca,DC=com&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.userSearchBase&lt;/name&gt; &lt;value&gt;Users,OU=Domain Users &amp; Groups,DC=ragaca,DC=com&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.userSearchScope&lt;/name&gt; &lt;value&gt;subtree&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.groupSearchBase&lt;/name&gt; &lt;value&gt;OU=Groups,OU=Domain Users &amp; Groups,DC=ragaca,DC=com&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.groupObjectClass&lt;/name&gt; &lt;value&gt;group&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;main.ldapRealm.memberAttribute&lt;/name&gt; &lt;value&gt;member&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;name&gt;urls./**&lt;/name&gt; &lt;value&gt;authcBasic&lt;/value&gt; &lt;/param&gt; &lt;/provider&gt; &lt;provider&gt; &lt;role&gt;identity-assertion&lt;/role&gt; &lt;name&gt;Default&lt;/name&gt; &lt;enabled&gt;true&lt;/enabled&gt; &lt;/provider&gt; &lt;provider&gt; &lt;role&gt;authorization&lt;/role&gt; &lt;name&gt;AclsAuthz&lt;/name&gt; &lt;enabled&gt;true&lt;/enabled&gt; &lt;/provider&gt; &lt;/gateway&gt; &lt;service&gt; &lt;role&gt;NAMENODE&lt;/role&gt; &lt;url&gt;hdfs://namenode1.ragaca.com:8020&lt;/url&gt; &lt;/service&gt; &lt;service&gt; &lt;role&gt;JOBTRACKER&lt;/role&gt; &lt;url&gt;rpc://jt.ragaca.com:8050&lt;/url&gt; &lt;/service&gt; &lt;service&gt; &lt;role&gt;WEBHDFS&lt;/role&gt; &lt;url&gt;http://namenode1.ragaca.com:50070/&lt;/url&gt; &lt;url&gt;http://namenode2.ragaca.com:50070/&lt;/url&gt; &lt;/service&gt; &lt;/topology&gt; </PRE><P>I also have hadoop.proxyuser.knox.hosts=* and hadoop.proxyuser.knox.groups=* in the core-site of the HDFS configuration</P><P>could anyone guess what am I missing</P><P>Thank you very much and happy new year</P> Fri, 29 Dec 2017 01:39:28 GMT shota 2017-12-29T01:39:28Z