Connection to PQS

[#1]

I'm trying to use Phoenix Query Server on my kerberized cluster.

I tried to connect to it with provided thin client tool without any success :

/sqlline-thin.py http://myserver.fqdn:8765 

Results with following error :

...
17/07/05 11:49:51 DEBUG auth.HttpAuthenticator: Authentication succeeded
17/07/05 11:49:51 DEBUG conn.DefaultManagedHttpClientConnection: http-outgoing-0: Close connection
17/07/05 11:49:51 DEBUG execchain.MainClientExec: Connection discarded
17/07/05 11:49:51 DEBUG conn.PoolingHttpClientConnectionManager: Connection released: [id: 0][route: {}->http://fr0-datalab-p31.bdata.corp:8765][total kept alive: 0; route allocated: 0 of 25; total allocated: 0 of 100]
java.lang.RuntimeException: Failed to execute HTTP Request, got HTTP/403
        at org.apache.calcite.avatica.remote.AvaticaCommonsHttpClientSpnegoImpl.send(AvaticaCommonsHttpClientSpnegoImpl.java:148)
        at org.apache.calcite.avatica.remote.RemoteProtobufService._apply(RemoteProtobufService.java:44)
        at org.apache.calcite.avatica.remote.ProtobufService.apply(ProtobufService.java:81)
        at org.apache.calcite.avatica.remote.Driver.connect(Driver.java:175)
        at sqlline.DatabaseConnection.connect(DatabaseConnection.java:157)
        at sqlline.DatabaseConnection.getConnection(DatabaseConnection.java:203)

However, it ends up with the cli prompt :

0: jdbc:phoenix:thin:url=http://myserver>

... but without any valid connection : As soon as I try to proceed with a "select" statement, I get "No current connection" message.

To solve this, I tried to execute

!connect myserver.fqdn myuser mypassword

but faced

No known driver to handle "myserver.fqdn"

It's worth saying that :

1. I performed a successfull "kinit" beforehand.
2. PQS runs fine on myserver.fqdn and listens on 8765 port (default one)

Any idea how I could investigate further this issue ?

Thanks for your help

[#2 · Accepted solution]

HTTP/403 means that you were able to successfully authenticate with the server, however you were disallowed due to authorization reasons (authentication and authorization are different things!)

What is the Kerberos principal your client is using and what is the Kerberos principal PQS is using? You could be running into CALCITE-1282 / PHOENIX-3004

[#3]

Hi Josh,

You are right, I gave a try using another principal for my client to match the realm of the principal used by PQS and it works fine now...

Thanks a lot for your help