question Ranger KMS Rest API commands not working in kerberized cluster in Archives of Support Questions (Read Only)

Ranger KMS Rest API commands not working in kerberized cluster

vandana_6 — Fri, 27 Jan 2017 22:32:17 GMT

Hi,

While executing the following Ranger KMS rest API command, we have encountered the exception:

command: curl -u admin:admin -X GET http://<ranger-KMS-server>:9292/kms/v1/keys/names

Exception: Authentication required-This request requires HTTP authentication.

We have created the keyadmin principal with the password keyadmin1 as configured in kms-properties. We can create keys and list keys via Ranger KMS UI. Please advice a solution ASAP.

Re: Ranger KMS Rest API commands not working in kerberized cluster

vperiasamy — Sat, 28 Jan 2017 05:45:58 GMT

Have you tried kinit'ing with the keyadmin principal and then trying the curl call with kerberos auth?

Re: Ranger KMS Rest API commands not working in kerberized cluster

vandana_6 — Mon, 30 Jan 2017 14:17:34 GMT

@vperiasamy I tried kiniting the keyadmin principal. But still facing the same authentication error.

Re: Ranger KMS Rest API commands not working in kerberized cluster

slachterman — Wed, 01 Feb 2017 01:59:08 GMT

@Vandana K R you need to use curl's negotiate option to authenticate via SPNEGO:

kinit -kt /etc/security/keytabs/rangerkms.service.keytab rangerkms/HOST@DOMAIN
curl --negotiate -u : -H 'Content-Type: application/json' http://HOST:9292/kms/v1/key/mykey/_metadata

Re: Ranger KMS Rest API commands not working in kerberized cluster

vandana_6 — Wed, 01 Feb 2017 18:54:58 GMT

@slachterman thank you it worked with negotiate.

Now when I disabled the kerberos and tried the same rest api command , same exception recreated.

command: curl -u keyadmin:keyadmin1 -X GET http://<ranger-KMS-server>:9292/kms/v1/keys/names

Exception: Authentication required-This request requires HTTP authentication.

Please advice

Re: Ranger KMS Rest API commands not working in kerberized cluster

slachterman — Wed, 01 Feb 2017 22:45:20 GMT

Hi @Vandana K R, that is really a separate question, would you mind accepting my answer if it resolved your issue and creating a separate post for this issue? That will make it easier for others to find this resolution in the future.

Re: Ranger KMS Rest API commands not working in kerberized cluster

vandana_6 — Thu, 02 Feb 2017 13:21:39 GMT

thank you,my issue has been resolved with negotiate option.