question Re: Ranger Solr on HDP 2.3.4 unable to refresh policies in Archives of Support Questions (Read Only)

Ranger Solr on HDP 2.3.4 unable to refresh policies

jstraub — Sat, 19 Mar 2016 15:17:00 GMT

I just installed a new cluster on HDP 2.3.4 with Solr 5.2.1 including Kerberos + Ranger Solr Plugin. Following this article https://community.hortonworks.com/articles/15159/securing-solr-collections-with-ranger-kerberos.html

However when I enable the Ranger Solr Plugin and restart solr I am seeing the following error:

632300 [Thread-15] WARN  org.apache.ranger.plugin.util.PolicyRefresher  [   ] – cache file does not exist or not readble 'null'
662301 [Thread-15] ERROR org.apache.ranger.plugin.util.PolicyRefresher  [   ] – PolicyRefresher(serviceName=null): failed to refresh policies. Will continue to use last known version of policies (-1)
com.sun.jersey.api.client.ClientHandlerException: java.lang.IllegalArgumentException: URI is not absolute
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:151)
        at com.sun.jersey.api.client.Client.handle(Client.java:648)
        at com.sun.jersey.api.client.WebResource.handle(WebResource.java:680)
        at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
        at com.sun.jersey.api.client.WebResource$Builder.get(WebResource.java:507)
        at org.apache.ranger.admin.client.RangerAdminRESTClient.getServicePoliciesIfUpdated(RangerAdminRESTClient.java:73)
        at org.apache.ranger.plugin.util.PolicyRefresher.loadPolicyfromPolicyAdmin(PolicyRefresher.java:205)
        at org.apache.ranger.plugin.util.PolicyRefresher.loadPolicy(PolicyRefresher.java:175)
        at org.apache.ranger.plugin.util.PolicyRefresher.run(PolicyRefresher.java:154)
Caused by: java.lang.IllegalArgumentException: URI is not absolute
        at java.net.URI.toURL(URI.java:1088)
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:159)
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:149)
        ... 8 more

This is what it looks like on HDP 2.3.2

INFO  - 2016-03-15 16:54:50.478; [   ] org.apache.ranger.plugin.util.PolicyRefresher; PolicyRefresher(serviceName=mycluster_solr): found updated version. lastKnownVersion=-1; newVersion=61

On 2.3.4 the serviceName is not replaced by the actual repository name, which was set in the install.properties file. On 2.3.2 the serviceName is replaced by the repository name <clustername>_solr.

Looks like a bug :(

Anyone seen this issue before? Any possible workaround?

Re: Ranger Solr on HDP 2.3.4 unable to refresh policies

rmani — Mon, 21 Mar 2016 13:38:48 GMT

Please check the value for property " ranger.plugin.solr.policy.rest.url" in ranger-solr-security.xml in the solr conf folder.

This should have the right value for the ranger admin. You can put the right value and restart solr plugin.

Not sure why the enabling of ranger solr plugin didnt update the right value. Did you see any exception in when you enabled solr plugin. May be you can try reinstalling it will be debug on the enable script to see if there are any exceptions and let us know.

Re: Ranger Solr on HDP 2.3.4 unable to refresh policies

rmani — Tue, 22 Mar 2016 06:16:56 GMT

@Jonas Straub Also please check that conf folder where there ranger config is there in the class path of the solr process. This might be the case for you.

Re: Ranger Solr on HDP 2.3.4 unable to refresh policies

jstraub — Wed, 06 Apr 2016 22:14:59 GMT

@Ramesh Mani I have checked your recommendation. Unfortunately it didnt help, any other ideas?

Re: Ranger Solr on HDP 2.3.4 unable to refresh policies

jstraub — Tue, 03 May 2016 13:35:34 GMT

@Ramesh Mani Thanks for the help and fixing the issue! Enabling the plugin basically changed the owner of /opt/solr/server/solr-webapp/webapp/WEB-INF/classes to root:root, changing it back to solr:solr solved the problem 😉