Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Authentication error in file view access via Ambari views

avatar
Contributor

I have LDAP & SSL working fine on HDP2.6.0.3 cluster where we have setup a standalone instance of Ambari Views on a edge node for security reasons. Now getting an Authentication error while trying to access the 'file views' using admin user. Log don't show any specific information.

Failed to transition to undefined

Authentication required

Failed to transition to undefined

Server status: 500


Server Message:

    
      Authentication required
    
  

Error trace:

    
      org.apache.hadoop.security.AccessControlException: Authentication required
	at org.apache.hadoop.hdfs.web.WebHdfsFileSystem.validateResponse(WebHdfsFileSystem.java:460)
	at org.apache.hadoop.hdfs.web.WebHdfsFileSystem.access$200(WebHdfsFileSystem.java:114)
	at org.apache.hadoop.hdfs.web.WebHdfsFileSystem$AbstractRunner.runWithRetry(WebHdfsFileSystem.java:750)
	at org.apache.hadoop.hdfs.web.WebHdfsFileSystem$AbstractRunner.access$100(WebHdfsFileSystem.java:592)
	at org.apache.hadoop.hdfs.web.W...
1 ACCEPTED SOLUTION

avatar
Master Mentor

@Vishal Gupta

Have you also enabled Kerberos on your Regular Ambari Server?

If yes then you will need to also specify the

hadoop.proxyuser.$AMBARI_PRINCIPAL.hosts =*
hadoop.proxyuser.$AMBARI_PRINCIPAL.groups=* 


This can be done in HDFS Configs -> Advanced -> Custom core-site

Please refer to the following doc for more details: https://docs.hortonworks.com/HDPDocuments/Ambari-2.6.0.0/bk_ambari-views/content/configuring_your_cl...

Example:

hadoop.proxyuser.ambari-server_democluster.groups=*
hadoop.proxyuser.ambari-server_democluster.hosts=*

Assuming that "ambari-server_democluster" is your ambari srver principal name.
If you have configured Ambari Server for Kerberos, be sure to modify this property name for the primary Kerberos principal user. 

.

You can also take a look at the other HCC threads like:

https://community.hortonworks.com/questions/131550/ambari-views-fail-after-kerberos-enabled.html

https://community.hortonworks.com/questions/7502/configuring-ambari-views-for-active-directory-user....

.

View solution in original post

2 REPLIES 2

avatar
Master Mentor

@Vishal Gupta

Have you also enabled Kerberos on your Regular Ambari Server?

If yes then you will need to also specify the

hadoop.proxyuser.$AMBARI_PRINCIPAL.hosts =*
hadoop.proxyuser.$AMBARI_PRINCIPAL.groups=* 


This can be done in HDFS Configs -> Advanced -> Custom core-site

Please refer to the following doc for more details: https://docs.hortonworks.com/HDPDocuments/Ambari-2.6.0.0/bk_ambari-views/content/configuring_your_cl...

Example:

hadoop.proxyuser.ambari-server_democluster.groups=*
hadoop.proxyuser.ambari-server_democluster.hosts=*

Assuming that "ambari-server_democluster" is your ambari srver principal name.
If you have configured Ambari Server for Kerberos, be sure to modify this property name for the primary Kerberos principal user. 

.

You can also take a look at the other HCC threads like:

https://community.hortonworks.com/questions/131550/ambari-views-fail-after-kerberos-enabled.html

https://community.hortonworks.com/questions/7502/configuring-ambari-views-for-active-directory-user....

.

avatar
Contributor

Thanks Jay. Everything is working now. Yes, the Regular Ambari has kerberos enabled. The links in the last message has been helpful. All the settings were correct except Authentication Method was set wrongly as SIMPLE. After changing the setting to Kerberos and adding the principle it started working. Also the keytabs on the standalone host was missing. Added the kebtab and kinit of prinicipal everything is fine. Thank you for prompt help.