Ranger tagsync failed with authorization error

[#1]

When I update ranger tag based repository with new policies I have an error in the tagsync log which says upload of service-tags failed with message 401

java.lang.Exception: Upload of service tags failed with response: PUT https://ranger-host>:6182/service/tags/importservicetags/ returned a response status of 401 Unauthorized

Ambari-2.6.1 & HDP-2.6.4

Kerberos & SSL enabled

[#2]

@Sudheer Velagapudi Response status 401 usually means a problem with authentication. I recommend you check ranger admin ui host /var/log/ranger/admin xa_portal.log, catalina.out and access.log for more information.

Also make sure ranger.tagsync.kerberos.keytab and ranger.tagsync.kerberos.principal are correctly set and that you can successfully run shell command kinit using the underlying file and principal.

[#3]

Ranger admin is running node01 & node02 and used external load balancer.

Added the spn for load balancer on node01 & node02.

Ranger tagsync is running on node02. It is using the keytab of en02 for rangertagsync user to update the tagstore and getting denied.

20 Apr 2018 13:28:55 DEBUG TagAdminRESTSink [Thread-7] - 143 Using Principal = rangertagsync/node02-priv.cluster.com@CLUSTER.COM 20 Apr 2018 13:28:55 DEBUG TagAdminRESTSink [Thread-7] - 173 ==> doUpload() 20 Apr 2018 13:28:55 ERROR TagAdminRESTSink [Thread-7] - 183 Upload of service-tags failed with message HTTP 401 20 Apr 2018 13:28:55 ERROR TagAdminRESTSink [Thread-7] - 152 Upload of service-tags failed with message java.lang.Exception: Upload of service-tags failed with response: PUT https://loadblancer.cluster.com:6182/service/tags/importservicetags/ returned a response status of 401 Unauthorized at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.uploadServiceTags(TagAdminRESTSink.java:187) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.access$000(TagAdminRESTSink.java:46) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink$1.run(TagAdminRESTSink.java:150) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink$1.run(TagAdminRESTSink.java:146) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:360) at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1849) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.doUpload(TagAdminRESTSink.java:146) at org.apache.ranger.tagsync.sink.tagadmin.TagAdminRESTSink.run(TagAdminRESTSink.java:255) at java.lang.Thread.run(Thread.java:748)

[#4]

This is what I gfound in the Ranger admin access log:

[26/Apr/2018:13:28:36 +0000] "GET /service/plugins/secure/policies/download/HDPCLUSTER_hbase?lastKnownVersion=172&lastActivationTime=1524514591769&pluginId=hbaseRegional@hadoop.cluster.com-HDPCLUSTER_hbase&clusterName=HDPCLUSTER HTTP/1.1" 401 - "-" "Java/1.8.0_161"