HiveServer2 won't start after changing Ranger's admin password

[#1]

Hello

HDP 2.3.2

Ambari 2.1.2.1

After changing the admin password of Ranger - both in the ranger UI and in the ambari under Advanced ranger-env the HiveServer2 fails to start. Ranger starts flawlessly - but HiveServer2 (which has Ranger authorization enabled) doesn't. If i disable the Ranger authorization from Hive (switching to none) HiveServer2 will start.

The error in the ambari is:

Traceback (most recent call last):
  File "/var/lib/ambari-agent/cache/common-services/HIVE/0.12.0.2.0/package/scripts/hive_server.py", line 193, in <module>
    HiveServer().execute()
  File "/usr/lib/python2.6/site-packages/resource_management/libraries/script/script.py", line 216, in execute
    method(env)
  File "/var/lib/ambari-agent/cache/common-services/HIVE/0.12.0.2.0/package/scripts/hive_server.py", line 85, in start
    setup_ranger_hive(rolling_upgrade=rolling_restart)
  File "/var/lib/ambari-agent/cache/common-services/HIVE/0.12.0.2.0/package/scripts/setup_ranger_hive.py", line 50, in setup_ranger_hive
    hdp_version_override = hdp_version)                 
  File "/usr/lib/python2.6/site-packages/resource_management/libraries/functions/setup_ranger_plugin_xml.py", line 78, in setup_ranger_plugin
    policy_user)
  File "/usr/lib/python2.6/site-packages/resource_management/libraries/functions/ranger_functions.py", line 92, in create_ranger_repository
    repo = self.get_repository_by_name_urllib2(repo_name, component, 'true', ambari_username_password_for_ranger)
  File "/usr/lib/python2.6/site-packages/resource_management/libraries/functions/ranger_functions.py", line 57, in get_repository_by_name_urllib2
    response = json.loads(result.read())
  File "/usr/lib/python2.6/site-packages/ambari_simplejson/__init__.py", line 307, in loads
    return _default_decoder.decode(s)
  File "/usr/lib/python2.6/site-packages/ambari_simplejson/decoder.py", line 335, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/lib/python2.6/site-packages/ambari_simplejson/decoder.py", line 353, in raw_decode
    raise ValueError("No JSON object could be decoded")

I've noticed there's a registered bug around this issue but it is unassigned and unresolved -https://issues.apache.org/jira/browse/AMBARI-13168

Any ideas how to workaround this issue ??

[#2]

Did you reset the password in Ranger config in Ambari after ranger admin password change? Ranger property in Advanced ranger-env -> admin_username and admin_password needs to be changed after reseting the Ranger admin password

[#3]

Hi rmani and thank you for replying.

As stated in my question - yes i did reset the password in Ranger UI >>>admin >> profile >> change password and also in Ambari >>>> Ranger >>>Advance ranger-env >>>> admin_password.

[#4]

I have simulated this issue in a different cluster and it is persistent - after changing Ranger's admin's password - in ranger UI & in Ambari >>> Ranger >> Advanced ranger-env - HiveServer2 won't start.

[#5]

@Adi Jabkowsky

Changing the password process is sensitive as per my experience

See the following doc.

http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.4/bk_Ranger_Install_Guide/content/updating_ran...

[#6]

Hi Neeraj and thank you for your reply !

I've went through this doc and did set the password in both of these places in Ambari >> Ranger. (Both under "Admin Settings" >>> Ranger Admin user's password for Ambari" & under Advanced ranger-env >>> admin password).However - problem remains.

It is very easy to reproduce - just change Ranger's admin password in UI + both places in Ambari and see for yourself. HiveServer2, if configured to authorize using Ranger, won't start. It has been confirmed and consistent on two different clusters.

[#7]

@Adi Jabkowsky FYI I changed password only in 1 location

[#8]

This bug prohibits us from using Ranger which is a great tool for permission governance.

[#9]

@Adi Jabkowsky I have experienced the same issue and to fix that I had to reinstall Ranger.

Do you have access to support?

Let me reproduce this

[#10]

I appreciate your offer but no support agreement yet unfortunately. We are still in (advanced) POC stages...

Thanks a lot anyways !

Highly appreciated.