Support Questions
Find answers, ask questions, and share your expertise

Enabling Ranger plugin for HDFS is giving error

Enabling the Ranger Plugins (checked with enabling HDFS and HIVE) after enabling the services and restarting the service it is giving the below error:

2016-10-04 11:21:26,825 - Error in call for getting Ranger service: Extra data: line 1 column 12 - line 1 column 50 (char 12 - 50)


what version of ambari /HDP are you using?

are there any errors in ranger logs?


Below are logs from ranger and namenode -

Ranger logs: xa_portal.logs

2016-10-14 12:53:24,486 [http-bio-6080-exec-3] WARN ( - Unable to read /etc/security/keytabs/spnego.service.keytab Please check the file access permissions for user

2016-10-14 12:53:24,486 [http-bio-6080-exec-3] WARN ( - Can't find principal : *

2016-10-14 12:53:37,447 [http-bio-6080-exec-9] WARN ( - Unable to read /etc/security/keytabs/spnego.service.keytab Please check the file access permissions for user

2016-10-14 12:53:37,448 [http-bio-6080-exec-9] WARN ( - Can't find principal : *
Namenode logs: hadoop-hdfs-namenode-<hostname>.log

2016-10-14 12:55:54,520 ERROR client.RangerAdminRESTClient ( - Error getting policies. secureMode=true, user=nn/el2714.bc@BGC.NET (auth:KERBEROS), response={"httpStatusCode":401,"statusCode":401,"msgDesc":"Authentication Failed"}, serviceName=BDADMIN_hadoop

2016-10-14 12:55:54,520 ERROR util.PolicyRefresher ( - PolicyRefresher(serviceName=BDADMIN_hadoop): failed to refresh policies. Will continue to use last known version of policies (-1)

java.lang.Exception: Authentication Failed

        at org.apache.ranger.admin.client.RangerAdminRESTClient.getServicePoliciesIfUpdated(

        at org.apache.ranger.plugin.util.PolicyRefresher.loadPolicyfromPolicyAdmin(

        at org.apache.ranger.plugin.util.PolicyRefresher.loadPolicy(



Hi @Sagar Shimpi ,

looking at the first error, there was at least an issue with accessing the keytab file for spnego auth.

Did you enable Kerberos recently before hitting your issue ? Were all the service checks fine ?

New Contributor
@Sagar Shimpi

Did you by any chance figure out the solution for above mentioned issue? If yes, would you mind sharing it?



@Pravin Gadakh The cluster was upgraded and the issue was no more. hence not able to get rca for the same.