Issue with Impala ODBC Authentication (CDP 7.1.9 – ODBC Driver 2.8.4)

[#1]

Hello,

I am working on a CDP 7.1.9 environment and I am currently testing the Impala ODBC connection using the Cloudera Impala ODBC Driver 2.8.4 on a Unix system with unixODBC.

The configuration is as follows:

• ODBC driver installed and registered in /etc/odbcinst.ini:

  [Cloudera ODBC Driver for Impala 64-bit]
  Description=Cloudera Impala ODBC Driver (64-bit)
  Driver=/opt/cloudera/impalaodbc/lib/64/libclouderaimpalaodbc64.so
  UsageCount=1

• DSN configured in /etc/odbc.ini
• SSL certificates correctly configured and integrated into the OS trust store
• Trying to connect using LDAP authentication (username/password)
  

  [Impala_CDP]
  Driver=/opt/cloudera/impalaodbc/lib/64/libclouderaimpalaodbc64.so
  Host=****************
  Port=21050
  Schema=*************
  AuthMech=3
  SSL=1
  TrustedCerts=/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
  LogLevel=6
  LogPath=/tmp/impala2.log

However, the connection fails with the following error:

isql -v Impala_CDP user "mdp"


[28000][unixODBC][Cloudera][ThriftExtension] (2) Error occurred during authentication.
[ISQL]ERROR: Could not SQLConnect

Relevant logs from the driver show that SSL verification is successful, but authentication fails.

The same credentials are working in another environment where authentication is successful.

tail -f clouderaodbcdriverforimpala_connection_0.log
mars 30 16:20:46.379 DEBUG 3705746048 Simba::ThriftExtension::TETSaslClientTransport::TETSaslClientTransport: +++++ exit +++++
mars 30 16:20:46.391 DEBUG 3705746048 DriverSupport::DSSSLUtils::SslDefaultVerifyCertCallback: The X509_STORE_CTX_get_error of SSL verification is: 0
mars 30 16:20:46.391 DEBUG 3705746048 DriverSupport::DSSSLUtils::SslVerifyCertCallback: Error depth: 1
mars 30 16:20:46.391 DEBUG 3705746048 DriverSupport::DSSSLUtils::SslDefaultVerifyCertCallback: The X509_STORE_CTX_get_error of SSL verification is: 0
mars 30 16:20:46.391 DEBUG 3705746048 DriverSupport::DSSSLUtils::SslVerifyCertCallback: Error depth: 0
mars 30 16:20:46.394 TRACE 3705746048 Simba::ThriftExtension::TEHttpApiRetryEmulationTestSettings::~TEHttpApiRetryEmulationTestSettings: +++++ enter +++++
mars 30 16:20:46.394 TRACE 3705746048 Simba::ImpalaODBC::ImpalaTCLIServiceClientFactory::~ImpalaTCLIServiceClientFactory: +++++ enter +++++
mars 30 16:20:46.395 TRACE 3705746048 Simba::ImpalaODBC::ImpalaConnection::SetProperty: +++++ enter +++++
mars 30 16:20:46.395 ERROR 3705746048 Simba::ODBC::Connection::SQLConnectW: [Cloudera][ThriftExtension] (2) Error occured during authentication.
mars 30 16:20:46.395 TRACE 3705746048 Simba::ThriftExtension::TEHttpApiRetryEmulationTestSettings::~TEHttpApiRetryEmulationTestSettings: +++++ enter +++++

Could you please help clarify and resolve this issue: 

• Any specific configuration required for LDAP authentication with this driver?
• If there are known compatibility issues between CDP 7.1.9 and this ODBC driver version?

Thank you for your support.

[#2]

Hello my name is Ezra and I am from Cloudera Impala team.

Your configurations for LDAP are correct (AuthMech=3 along with including a username and password when connecting). Additionally, you have a different environment where this same configuration authenticates, so I think that part is fine. You can refer to Impala ODBC documentation to verify your setup.

There is not a know compatibility issue with ODBC driver and authentication.

I suspect your configurations are right, and the connection may actually be reaching the Impala Daemon, but authentication is failing when the Impala Daemon is then verifying with LDAP server.

SUGGESTION

If you are connecting directly to an Impala Daemon (instead of Impala Load Balancer), can you check the Impala Daemon logs from that host to see if the authentication error also shows up in Impala Daemon logs? This would imply the connection is actually reaching Impala fine. If you are connecting via Load Balancer, please check all Impala Daemon Coordinator's logs for the failed connection at the timestamp.

Now if you do see authentication error in Impala Daemon log side, can you verify your LDAP configurations in Impala > Configuration > search 'ldap' are all correct? Maybe manually connect with ldapsearch on same Impala Daemon using same settings and your user? You can talk with your LDAP team further on debugging this.

If you can try setting up Kerberos connection instead of LDAP connection in your ini file, maybe that will work (AuthMech=1). Since it looks to be authentication error rather than generally connectivity error. Refer to documentation to add the other kerberos configs.

If you do not see any trace of the error or attempted client connection in any of your Impala Daemon logs, I would recommend testing network connectivity outside of ODBC driver/isql to the Impala host: telnet, firewall, tcpdump, etc. To see if anything is blocking.

I hope this helps uncover the root cause.

[#3]

Hi @Karma12,

isql -v Impala_CDP user "mdp"

is mdp your username? If yes, can you try as follows:

isql -v Impala_CDP mdp <your_password>

Let me know if this helps.