Dear Community Members,
We have just enabled, SSL on ranger and Ambari , ranger-admin and ambari just works fine as well, although we are not able to make usersync working with LDAPS since we are constantly getting the following
error.com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
We have followed the official HDP documentation placed here: https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.6.4/bk_security/content/configuring_ranger_for_...
Also tried the following article: https://community.hortonworks.com/questions/1018/how-to-configure-ranger-usync-for-ldap-ssl.html
This is also a bug: https://issues.apache.org/jira/browse/RANGER-840 but should have been resolved.
The certificates looks fine since we enabled other HTTPS services also with the same certificates, our cacert file is located at the following path: /etc/pki/ca-trust/extracted/java/cacerts
Following has been set for the ranger.usersync.truststore.file=/etc/pki/ca-trust/extracted/java/cacerts
HDP version: 22.214.171.124
Ranger version: 0.7
Any hints or pointer will be appreciated, thanks in advance.
Hi @Hammad Ali,
That error seems to be because you are not using the correct SSL certificates for your AD/LDAP.
Assuming that you have a separate AD/LDAP instance, that AD/LDAP has is own SSL certificates and you should be using that specific SSL certificates and not the SSL certificates that you used to enable HTTPS.
Create a new key store and import all the public key certificates of the AD/LDAP including the CA and Intermediate of that SSL's.
Then update the following properties in "Advanced ranger-ugsync-site" in Ranger service:
Restart Ranger service.