Ambari UI via Knox - Limited accessibility

[#1]

I have followed this guide to enable Knox for the Ambari cluster:

https://community.hortonworks.com/articles/78361/configure-knox-to-access-ambari-ui.html

While I am able to log into the Ambari UI via Knox. I cannot view the hosts nor am I able to access the preconfigured 'Views':

- Hive View

- Files View

- Smartsense View

- Tez View etc..

I have also noticed that alerts and warnings do not show either.

Why am I a limited user despite logging in with an admin account?

Thanks in advance

[#2]

@Jay Kumar SenSharma

Snippet:

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
        at sun.security.validator.Validator.validate(Validator.java:260)
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)
        ... 76 more

Its strange because originally it was working. I will give that guide a go now.

Thanks!

EDIT: This was from the Knox Gateway log /var/log/knox/gateway.log

[#3]

@L V

The above Snippet is also not complete. We need to see the complete error from where it begin ... till end of this stack trace to understand which API is causing this error.

Also please let us know if you have configured truststore in ambari server?

Is this snippet appearing in the "ambari-server.log" ?

When exactly are we getting this error? While Accessing any specific view (Like Capacity Scheduler View)? Or while accessing ambari UI ?

Is your ambari server listening on SSL port ?

[#4]

Hi @Jay Kumar SenSharma

I have configured the truststore and enabled SSL for Ambari. It is currently listening on port 8443 and I am able to access Ambari UI normally (now via HTTPS). I am still receiving the same error when trying to access it via Knox.

The log is from /var/log/knox/ (Not located on the ambari host server)

Full Log: gateway.txt

[#5]

@Jay Kumar SenSharma I am unable to access Ambari UI at all when trying through Knox. I'm met with a HTTP 500 error

[#6]

@L V

By any chance are you specifying the HTTPS protocol in the Knox topology for the Ambari Server URL (like. https://$AMBARI_HOST:8080)

.

Please check if you are running your ambari server on HTTPS ? If yes then please import the Ambari Server's certificate to the Knox keystore.

[#7]

@Jay Kumar SenSharma

I have set the Ambari Server URL as follows:

https://$AMBARI_HOST:8443

I am unable to import any certificates into the Knox keystore.

Using the following command:

keytool -importcert -file test.csr -keystore gateway.jks -alias "gateway-identity" 

along with the Knox Master Secret password although I get the error:

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect.

Note I have created the alias with this command:

knoxcli.sh create-alias gateway-identity-passphrase --value {value}

I have even removed and re-installed Knox and reset the Master Secret password, again same error.

[#8]

L V I think you need to import the ambari certificate to the java cacert of knox , and make sure you have hostname of ambari as CN in the ambari certificate

[#9]

@L V

As you got message like "Keystore was tampered with, or password was incorrect." which indicates that you might have entered incorrect storepassword while importing the ambari server keystore to knox keystore.

You can verify the "gatewar.jks" by listing the certificates present in it. Please try "-list" command to see if ambari server certificate is imported to the knox truststore or not?

# /usr/jdk64/jdk1.8.0_112/bin/keytool -list -v -keystore /var/lib/knox/data-2.6.4.0-91/security/keystores/gateway.jks
Enter keystore password:  admin

.

[#10]

Hi @Jay Kumar SenSharma

That worked, although when I go and access other services and try view their UI's it just diverts back to their original IP address.

Lets take YARN as an example, this is the configuration I have currently entered into the topology:

            <service>
                  <role>YARN</role>
                  <url>http://192.168.XXX.XXX:8088</url>
             </service>
             <service>
                   <role>YARNUI</role>
                   <url>http://192.168.XXX.XXX:8088</url>
            </service>

[#11]

@L V

Ambari provides the quicklink.json feature the alter the Quicklinks as we want.

In case of knox enabled cluster we might need to alter the quicklinks a bit like described in the following link:

1. https://community.hortonworks.com/questions/88500/how-to-make-ambari-quick-links-to-point-to-knox-ga...

2. https://cwiki.apache.org/confluence/display/AMBARI/Quick+Links