Ranger knox repo test connection failure

[#1]

Install service knox successfully using self signed and integrated with Ranger. But on Ranger UI clicking on Knox test connection gets failed with below error. Below find first details of cluster.

Details:

HDP: 2.6

Kerberos Enabled: YES ( Windows AD 2012 R2)

Authentication: AD with LDAPS ( Windows AD 2012 R2)

Ranger Enabled: YES

RANGER Usersync and GroupSync: YES with windows AD

Ambari Enabled AD: YES

KNOX Enabled with AD: YES (except Admin account/topology)

KNOX advance topology have definition for zookeeper dynamic discovery and webhdfs ha: YES

Knox repository visible in Ranger UI: YES

Error":

While clicking on test connection getting below error.

2017-12-22 10:32:28,699 [timed-executor-pool-0] ERROR apache.ranger.services.knox.client.KnoxClient (KnoxClient.java:158) - Exception on REST call to KnoxUrl : https://vijayhdp-1.novalocal:8443/gateway/admin/api/v1/topologies. com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:131) at com.sun.jersey.api.client.filter.HTTPBasicAuthFilter.handle(HTTPBasicAuthFilter.java:81) at com.sun.jersey.api.client.Client.handle(Client.java:616) at com.sun.jersey.api.client.WebResource.handle(WebResource.java:559) at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:72) at com.sun.jersey.api.client.WebResource$Builder.get(WebResource.java:454) at org.apache.ranger.services.knox.client.KnoxClient.getTopologyList(KnoxClient.java:99) at org.apache.ranger.services.knox.client.KnoxClient$2.call(KnoxClient.java:406) at org.apache.ranger.services.knox.client.KnoxClient$2.call(KnoxClient.java:402) at org.apache.ranger.services.knox.client.KnoxClient.timedTask(KnoxClient.java:431) at org.apache.ranger.services.knox.client.KnoxClient.getKnoxResources(KnoxClient.java:410) at org.apache.ranger.services.knox.client.KnoxClient.connectionTest(KnoxClient.java:315) at org.apache.ranger.services.knox.client.KnoxResourceMgr.validateConfig(KnoxResourceMgr.java:43) at org.apache.ranger.services.knox.RangerServiceKnox.validateConfig(RangerServiceKnox.java:56) at org.apache.ranger.biz.ServiceMgr$ValidateCallable.actualCall(ServiceMgr.java:560) at org.apache.ranger.biz.ServiceMgr$ValidateCallable.actualCall(ServiceMgr.java:547) at org.apache.ranger.biz.ServiceMgr$TimedCallable.call(ServiceMgr.java:508) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) Caused by: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

On Ranger UI - Audit - plugins - no knox pluging names data present.

Kindly suggest to fix it.

- Vijay Mishra

[#2]

Vijay Mishra, can you try the suggestions posted in this article

[#3]

@vsuvagia

I already have done the SSL truststore for knox with ranger but it was failing.

As per article which u refered they talked if not working then update below property in ranger-admin

1. ranger.truststore.file=/usr/hdp/current/ranger-admin/cacertswithknox
2. ranger.truststore.password=changeit

Which i have done and ranger knox Test connection is success.

Thanks for sharing the article helps to fix the issue.

- Vijay Mishra

[#4]

@Vijay Mishra, The mentioned properties should now be available on Ambari Ranger-configurations, and you might not need to add the properties to ranger-admin*.sh script manually.
Glad to know the issue was fixed.

[#5]

Correct steps for Using Ranger with KNOX

1. Install Ranger and setup SSL for Ranger Admin

2. Install Knox and do topology xml changes.

3. Enable Knox plugin and setup SSL for Knox plugin

4. Add "ranger-admin-trust.cer" into cacerts file of java using below command on knox host

"/usr/jdk64/jdk1.8.0_112/bin/keytool -import -file /etc/ranger/admin/conf/ranger-admin-trust.cer -alias rangeradmin -keystore /usr/jdk64/jdk1.8.0_112/jre/lib/security/cacerts"

5. Followe the steps for Knox test connection to be successful

can you please check if you missed any of this?

[#6]

Deepak Sharma

Issue fixed, have done the same steps which u have mentioned above.

In ur steps u have mentioned install knox and do ui.xml changes, r u talking about topology files ?

- Vijay Mishra

[#7]

yes Vijay its topology file changes only