Ranger KMS Rest API commands not working in kerberized cluster

[#1]

Hi,

While executing the following Ranger KMS rest API command, we have encountered the exception:

command: curl -u admin:admin -X GET http://<ranger-KMS-server>:9292/kms/v1/keys/names

Exception: Authentication required-This request requires HTTP authentication.

We have created the keyadmin principal with the password keyadmin1 as configured in kms-properties. We can create keys and list keys via Ranger KMS UI. Please advice a solution ASAP.

[#2]

Have you tried kinit'ing with the keyadmin principal and then trying the curl call with kerberos auth?

[#3]

@vperiasamy I tried kiniting the keyadmin principal. But still facing the same authentication error.

[#4 · Accepted solution]

@Vandana K R you need to use curl's negotiate option to authenticate via SPNEGO:

kinit -kt /etc/security/keytabs/rangerkms.service.keytab rangerkms/HOST@DOMAIN
curl --negotiate -u : -H 'Content-Type: application/json' http://HOST:9292/kms/v1/key/mykey/_metadata

[#5]

@slachterman thank you it worked with negotiate.

Now when I disabled the kerberos and tried the same rest api command , same exception recreated.

command: curl -u keyadmin:keyadmin1 -X GET http://<ranger-KMS-server>:9292/kms/v1/keys/names

Exception: Authentication required-This request requires HTTP authentication.

Please advice

[#6]

Hi @Vandana K R, that is really a separate question, would you mind accepting my answer if it resolved your issue and creating a separate post for this issue? That will make it easier for others to find this resolution in the future.

[#7]

thank you,my issue has been resolved with negotiate option.