Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Ranger tagsync failed with authorization error

Highlighted

Ranger tagsync failed with authorization error

Contributor

When I update ranger tag based repository with new policies I have an error in the tagsync log which says upload of service-tags failed with message 401

java.lang.Exception: Upload of service tags failed with response: PUT https://ranger-host>:6182/service/tags/importservicetags/ returned a response status of 401 Unauthorized

Ambari-2.6.1 & HDP-2.6.4

Kerberos & SSL enabled

3 REPLIES 3

Re: Ranger tagsync failed with authorization error

@Sudheer Velagapudi Response status 401 usually means a problem with authentication. I recommend you check ranger admin ui host /var/log/ranger/admin xa_portal.log, catalina.out and access.log for more information.

Also make sure ranger.tagsync.kerberos.keytab and ranger.tagsync.kerberos.principal are correctly set and that you can successfully run shell command kinit using the underlying file and principal.

Re: Ranger tagsync failed with authorization error

Contributor

Ranger admin is running node01 & node02 and used external load balancer.

Added the spn for load balancer on node01 & node02.

Ranger tagsync is running on node02. It is using the keytab of en02 for rangertagsync user to update the tagstore and getting denied.

20 Apr 2018 13:28:55 DEBUG TagAdminRESTSink [Thread-7] - 143 Using Principal = rangertagsync/node02-priv.cluster.com@CLUSTER.COM 20 Apr 2018 13:28:55 DEBUG TagAdminRESTSink [Thread-7] - 173 ==> doUpload() 20 Apr 2018 13:28:55 ERROR TagAdminRESTSink [Thread-7] - 183 Upload of service-tags failed with message HTTP 401 20 Apr 2018 13:28:55 ERROR TagAdminRESTSink [Thread-7] - 152 Upload of service-tags failed with message java.lang.Exception: Upload of service-tags failed with response: PUT https://loadblancer.cluster.com:6182/service/tags/importservicetags/ returned a response status of 401 Unauthorized at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.uploadServiceTags(TagAdminRESTSink.java:187) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.access$000(TagAdminRESTSink.java:46) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink$1.run(TagAdminRESTSink.java:150) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink$1.run(TagAdminRESTSink.java:146) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:360) at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1849) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.doUpload(TagAdminRESTSink.java:146) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.run(TagAdminRESTSink.java:255) at java.lang.Thread.run(Thread.java:748)

Re: Ranger tagsync failed with authorization error

Contributor

This is what I gfound in the Ranger admin access log:

[26/Apr/2018:13:28:36 +0000] "GET /service/plugins/secure/policies/download/HDPCLUSTER_hbase?lastKnownVersion=172&lastActivationTime=1524514591769&pluginId=hbaseRegional@hadoop.cluster.com-HDPCLUSTER_hbase&clusterName=HDPCLUSTER HTTP/1.1" 401 - "-" "Java/1.8.0_161"
Don't have an account?
Coming from Hortonworks? Activate your account here