Error Getting Policies and Tags 401 after Enable Ranger HA in kerberized ambari

[#1]

I set up a Haproxy service:

listen ranger_admin

    bind 0.0.0.0:6080

    mode tcp

    server ranger_node1:6080 

    server ranger_node2:6080

Then I refer to the document，

https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.0/fault-tolerance/content/configuring_ranger_adm...

from 32 steps to the end.

I found the Ranger authorization invalid.

Namenode log error:

WARN client.RangerAdminRESTClient (RangerAdminRESTClient.java:getServicePoliciesIfUpdated(182)) - Error getting policies. secureMode=true, user=nn/node1@TEST.COM (auth:KERBEROS), response={"httpStatusCode":401,"statusCode":0}, serviceName=Captain_hadoop
WARN client.RangerAdminRESTClient (RangerAdminRESTClient.java:getServiceTagsIfUpdated(365)) - Error getting tags. secureMode=true, user=nn/node1@TEST.COM (auth:KERBEROS), response={"httpStatusCode":401,"statusCode":0}, serviceName=Captain_hadoop

Ranger admin access log error:

"GET /service/plugins/secure/policies/download/Captain_hadoop?lastKnownVersion=8&lastActivationTime=1650799134085&pluginId=hdfs@node1-Captain_hadoop&clusterName=Captain&supportsPolicyDeltas=false HTTP/1.1" 401 - "-" "Java/1.8.0_202"

May I ask how to solve this situation，Is there any kind person who can help? Thank you very much!

[#2]

Hello Ken, from the snippet it seems the plugin is trying to download policies but fails with 401 response.

Can you please make sure we have the HTTP Principal of each of the Ranger Admin and load-balancer nodes to the Spnego keytab file and also check if we have the correct keytab and principal values in Ranger configs? 

[#3 · Accepted solution]

Thank you! After seeing your help, I checked this document and then solved the problem, thanks again.

https://docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.0/fault-tolerance/content/configuring_ranger_adm...

[#4]

@ken_zz, Thank you for your participation in Cloudera Community. I'm happy to see you resolved your issue. Please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.