Support Questions

Find answers, ask questions, and share your expertise

kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response

Contributor

cdh5.0.2

hue3.5

 

cdh was configured hadoop security with cloudera manager.

can not Save Query Results Big Query in HDFS .

user:hue

the error:

kerberos_    ERROR    handle_other(): Mutual authentication unavailable on 200 response

 20140624203933.jpg

16 REPLIES 16

Seems like a misconfiguration.

Do you have any other warnings on the Hue page /about/admin_wizard ?

Romain

Contributor
 The warnings on the Hue page /about/admin_wizard:
"Potential misconfiguration detected. Fix and restart Hue.
Impala Editor No available Impalad to send queries to.
 
no other warnings.
It has nothing to do with this warnning,must be some other misconfiguration.

 

Contributor
ps: the service kt_renewer is running.

Contributor

Click the 'select a file or directory',the error.log print the error too.

Could you describe more: are you trying to export the result of a Hive
query into HDFS?

Could you provide the full trace from the /logs page when the error happens?

Romain

Contributor

yes,I export hive query result to hdfs with method 'big query in hdfs'.

 

the /logs:

25/Jun/2014 21:50:10 -0700] access WARNING 172.20.0.224 hue - "GET /logs HTTP/1.1"
[25/Jun/2014 21:50:07 -0700] resource DEBUG GET Got response: {"FileStatus":{"accessTime":0,"b...
[25/Jun/2014 21:50:07 -0700] kerberos_ DEBUG handle_response(): returning <Response [200]>
[25/Jun/2014 21:50:07 -0700] kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response
[25/Jun/2014 21:50:07 -0700] kerberos_ DEBUG handle_other(): Handling: 200
[25/Jun/2014 21:50:07 -0700] connectionpool DEBUG "GET /webhdfs/v1/user/hue/kt?op=GETFILESTATUS&user.name=hue&doas=hue HTTP/1.1" 200 None
[25/Jun/2014 21:50:07 -0700] connectionpool DEBUG Setting read timeout to None
[25/Jun/2014 21:50:07 -0700] dbms DEBUG Query Server: {'server_host': 'datanode12.yeahmobi.com', 'server_port': 10000, 'server_name': 'beeswax', 'principal': 'hive/datanode12.yeahmobi.com@HADOOP.COM'}
[25/Jun/2014 21:50:07 -0700] thrift_util DEBUG Thrift call <class 'TCLIService.TCLIService.Client'>.GetOperationStatus returned in 1ms: TGetOperationStatusResp(status=TStatus(errorCode=None, errorMessage=None, sqlState=None, infoMessages=None, statusCode=0), operationState=2, errorMessage=None, sqlState=None, errorCode=None)
[25/Jun/2014 21:50:07 -0700] thrift_util DEBUG Thrift call: <class 'TCLIService.TCLIService.Client'>.GetOperationStatus(args=(TGetOperationStatusReq(operationHandle=TOperationHandle(hasResultSet=True, modifiedRowCount=None, operationType=0, operationId=THandleIdentifier(secret='Y^\xc1\xcb\x93\xaeN\xce\x8ao\x10\x9b\x1f\xf6\xa3\xf2', guid='\xe2\xaaM\xca\xba\x8dK\xf1\xb1\xa2\xb7\x1b\xe3a\x0e\x82'))),), kwargs={})
[25/Jun/2014 21:50:07 -0700] dbms DEBUG Query Server: {'server_host': 'datanode12.yeahmobi.com', 'server_port': 10000, 'server_name': 'beeswax', 'principal': 'hive/datanode12.yeahmobi.com@HADOOP.COM'}
[25/Jun/2014 21:50:07 -0700] access INFO 172.20.0.224 hue - "POST /beeswax/api/query/32/results/save/hdfs/directory HTTP/1.1"
[25/Jun/2014 21:50:04 -0700] thrift_util DEBUG Thrift call <class 'hadoop.api.jobtracker.Jobtracker.Client'>.getRunningJobs returned in 1ms: ThriftJobList(jobs=[])
[25/Jun/2014 21:50:04 -0700] thrift_util DEBUG Thrift call: <class 'hadoop.api.jobtracker.Jobtracker.Client'>.getRunningJobs(args=(RequestContext(confOptions={'effective_user': u'hue'}),), kwargs={})
[25/Jun/2014 21:50:04 -0700] access INFO 172.20.0.224 hue - "GET /jobbrowser/ HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /favicon.ico HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] thrift_util DEBUG Thrift call <class 'hadoop.api.jobtracker.Jobtracker.Client'>.getRunningJobs returned in 1ms: ThriftJobList(jobs=[])
[25/Jun/2014 21:50:00 -0700] thrift_util DEBUG Thrift call: <class 'hadoop.api.jobtracker.Jobtracker.Client'>.getRunningJobs(args=(RequestContext(confOptions={'effective_user': u'hue'}),), kwargs={})
[25/Jun/2014 21:50:00 -0700] access INFO 172.20.0.224 hue - "GET /jobbrowser/ HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /static/art/icon_hue_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /oozie/static/art/icon_oozie_dashboard_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /oozie/static/art/icon_oozie_editor_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /sqoop/static/art/icon_sqoop_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /hbase/static/art/icon_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /zookeeper/static/art/icon_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /metastore/static/art/icon_metastore_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /impala/static/art/icon_impala_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /beeswax/static/art/icon_beeswax_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /rdbms/static/art/icon_rdbms_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /jobsub/static/art/icon_jobsub_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /pig/static/art/icon_pig_24.png HTTP/1.1"
[25/Jun/2014 21:50:00 -0700] access DEBUG 172.20.0.224 hue - "GET /static/art/hue-logo-mini-white.png HTTP/1.1"

Contributor

hello Romain:

 

When I click 'file blowser',this error show in the runcpserver.log:

[27/Jun/2014 14:31:08 +0800] kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response
[27/Jun/2014 14:31:08 +0800] kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response
[27/Jun/2014 14:31:08 +0800] kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response
[27/Jun/2014 14:31:08 +0800] kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response
[27/Jun/2014 14:31:08 +0800] kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response
[27/Jun/2014 14:31:08 +0800] kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response

Any configuration I missed?

You might already know what Michalis found, but it is a false positive
warning: https://issues.cloudera.org/browse/HUE-2198

If the query result is correctly exported to HDFS it wold confirm this.

Romain

Contributor

“Could not save results”。The  mapreduce job of exporting data couldn't be created,so the query result is not exported to HDFS.

 

Maybe there is  a error occured before the mapreduce job created.

You probably have a HDFS or Hive misconfiguration.

Does this type of query work?

INSERT OVERWRITE DIRECTORY '/tmp/path_hdfs' SELECT * from table_1

Romain

Contributor

Not work.

the sql:

INSERT OVERWRITE DIRECTORY '/user/hue/test'  select * from cc_log;

the error log:

[07/Jul/2014 14:22:53 +0800] views INFO Saved auto design "My saved query" (id 26) for hue
[07/Jul/2014 14:22:54 +0800] dbms ERROR Bad status for request TExecuteStatementReq(confOverlay={}, sessionHandle=TSessionHandle(sessionId=THandleIdentifier(secret='\x16\x037i\xeb\x18O\x86\x9b\xa6\x9f\x0f\xde\xd8\xd1 ', guid='\x1cV\xeb\xa5\x88\xd6@\xec\x93(\tt\x101\xb3\x90')), runAsync=True, statement="INSERT OVERWRITE DIRECTORY '/user/hue/test' select * from cc_log"):
TExecuteStatementResp(status=TStatus(errorCode=40000, errorMessage='Error while compiling statement: FAILED: SemanticException No valid privileges', sqlState='42000', infoMessages=None, statusCode=3), operationHandle=None)
Traceback (most recent call last):
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/dbms.py", line 402, in execute_and_watch
handle = self.client.query(query, query_history.statement_number)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 666, in query
return self._client.execute_async_query(query, statement)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 503, in execute_async_query
return self.execute_async_statement(statement=query_statement, confOverlay=configuration)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 515, in execute_async_statement
res = self.call(self._client.ExecuteStatement, req)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 427, in call
raise QueryServerException(Exception('Bad status for request %s:\n%s' % (req, res)), message=message)
QueryServerException: Bad status for request TExecuteStatementReq(confOverlay={}, sessionHandle=TSessionHandle(sessionId=THandleIdentifier(secret='\x16\x037i\xeb\x18O\x86\x9b\xa6\x9f\x0f\xde\xd8\xd1 ', guid='\x1cV\xeb\xa5\x88\xd6@\xec\x93(\tt\x101\xb3\x90')), runAsync=True, statement="INSERT OVERWRITE DIRECTORY '/user/hue/test' select * from cc_normal_log"):
TExecuteStatementResp(status=TStatus(errorCode=40000, errorMessage='Error while compiling statement: FAILED: SemanticException No valid privileges', sqlState='42000', infoMessages=None, statusCode=3), operationHandle=None)

 

and the sentry provider file:

analyst_role = server=server1->db=analyst1, \
server=server1->db=jranalyst1->table=*->action=select,\
server=server1->db=default->table=*->action=select,\
server=server1->db=test->table=*->action=select,\
server=server1->db=test->table=*->action=create,\
server=server1->uri=hdfs://namenode11:8020/user/hue/test

You are having:
SemanticException No valid privileges

You need to authorize this path, check the ->uri Sentry syntax:
http://www.cloudera.com/content/cloudera-content/cloudera-docs/CDH4/4.5.0/CDH4-Security-Guide/cdh4sg...

Romain

Contributor

Thanks for you regards!

 

sentry configuration:

1.server=server1->uri=hdfs://namenode11.yeahmobi.com:8020/tmp/analyst/test

2. this directory is writable and readable

the sql "INSERT OVERWRITE DIRECTORY 'hdfs://namenode11.yeahmobi.com:8020/tmp/analyst/test'  select * from cc_normal_log limit 10"  runs ok.

 

But "Save Query Results big query in hdfs " still not work....

 

 

rube

What path did you put in the box?

It needs to be allowed by Sentry too.

Romain

Contributor

I chose the same path:'hdfs://namenode11.yeahmobi.com:8020/tmp/analyst/test'

Expert Contributor

Hello @prabhat10,

 

For understanding scenario write, as per your description following is the assumption:

  • Assuming, node1 host = cm1
  • haproxy and hs2 are on same host

If above assumptions are right and assuming your environment have not option but to keep haproxy and hs2 on different hosts then change the thrift ports.

 

Hope that helps.

Take a Tour of the Community
Don't have an account?
Your experience may be limited. Sign in to explore more.