kerberos_ ERROR handle_other(): Mutual authentication unavailable on 200 response

[#1]

cdh5.0.2

hue3.5

cdh was configured hadoop security with cloudera manager.

can not Save Query Results Big Query in HDFS .

user:hue

the error:

kerberos_    ERROR    handle_other(): Mutual authentication unavailable on 200 response

 

[#2]

You probably have a HDFS or Hive misconfiguration.

Does this type of query work?

INSERT OVERWRITE DIRECTORY '/tmp/path_hdfs' SELECT * from table_1

Romain

[#3]

Not work.

the sql:

INSERT OVERWRITE DIRECTORY '/user/hue/test'  select * from cc_log;

the error log:

[07/Jul/2014 14:22:53 +0800] views INFO Saved auto design "My saved query" (id 26) for hue
[07/Jul/2014 14:22:54 +0800] dbms ERROR Bad status for request TExecuteStatementReq(confOverlay={}, sessionHandle=TSessionHandle(sessionId=THandleIdentifier(secret='\x16\x037i\xeb\x18O\x86\x9b\xa6\x9f\x0f\xde\xd8\xd1 ', guid='\x1cV\xeb\xa5\x88\xd6@\xec\x93(\tt\x101\xb3\x90')), runAsync=True, statement="INSERT OVERWRITE DIRECTORY '/user/hue/test' select * from cc_log"):
TExecuteStatementResp(status=TStatus(errorCode=40000, errorMessage='Error while compiling statement: FAILED: SemanticException No valid privileges', sqlState='42000', infoMessages=None, statusCode=3), operationHandle=None)
Traceback (most recent call last):
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/dbms.py", line 402, in execute_and_watch
handle = self.client.query(query, query_history.statement_number)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 666, in query
return self._client.execute_async_query(query, statement)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 503, in execute_async_query
return self.execute_async_statement(statement=query_statement, confOverlay=configuration)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 515, in execute_async_statement
res = self.call(self._client.ExecuteStatement, req)
File "/usr/lib/hue/apps/beeswax/src/beeswax/server/hive_server2_lib.py", line 427, in call
raise QueryServerException(Exception('Bad status for request %s:\n%s' % (req, res)), message=message)
QueryServerException: Bad status for request TExecuteStatementReq(confOverlay={}, sessionHandle=TSessionHandle(sessionId=THandleIdentifier(secret='\x16\x037i\xeb\x18O\x86\x9b\xa6\x9f\x0f\xde\xd8\xd1 ', guid='\x1cV\xeb\xa5\x88\xd6@\xec\x93(\tt\x101\xb3\x90')), runAsync=True, statement="INSERT OVERWRITE DIRECTORY '/user/hue/test' select * from cc_normal_log"):
TExecuteStatementResp(status=TStatus(errorCode=40000, errorMessage='Error while compiling statement: FAILED: SemanticException No valid privileges', sqlState='42000', infoMessages=None, statusCode=3), operationHandle=None)

and the sentry provider file:

analyst_role = server=server1->db=analyst1, \
server=server1->db=jranalyst1->table=*->action=select,\
server=server1->db=default->table=*->action=select,\
server=server1->db=test->table=*->action=select,\
server=server1->db=test->table=*->action=create,\
server=server1->uri=hdfs://namenode11:8020/user/hue/test

[#4]

You are having:
SemanticException No valid privileges

You need to authorize this path, check the ->uri Sentry syntax:
http://www.cloudera.com/content/cloudera-content/cloudera-docs/CDH4/4.5.0/CDH4-Security-Guide/cdh4sg...

Romain

[#5]

Thanks for you regards!

sentry configuration:

1.server=server1->uri=hdfs://namenode11.yeahmobi.com:8020/tmp/analyst/test

2. this directory is writable and readable

the sql "INSERT OVERWRITE DIRECTORY 'hdfs://namenode11.yeahmobi.com:8020/tmp/analyst/test'  select * from cc_normal_log limit 10"  runs ok.

But "Save Query Results big query in hdfs " still not work....

rube

[#6]

What path did you put in the box?

It needs to be allowed by Sentry too.

Romain

[#7]

I chose the same path:'hdfs://namenode11.yeahmobi.com:8020/tmp/analyst/test'

[#8]

Hello @prabhat10,

For understanding scenario write, as per your description following is the assumption:

• Assuming, node1 host = cm1
• haproxy and hs2 are on same host

If above assumptions are right and assuming your environment have not option but to keep haproxy and hs2 on different hosts then change the thrift ports.

Hope that helps.