Hi @PrernaU , It seems like the logged in user does not have permission to access the interpreter page. The authorization is dependent on how you have configured your shiro authentication. If you have integrated your AD with zeppelin the make sure the role mapping has done correctly and you have the correct user/group defined in the shiro roles section. ... View more

@wbivp    I created a community article long ago that details the Ranger based "NiFi Resource Identifier" policy strings you would use in Ranger to provide various levels of authorization within NiFi. https://community.cloudera.com/t5/Community-Articles/NiFi-Ranger-based-policy-descriptions/ta-p/246586 For example, it you want to grant access so that users can access and create components within a PG: /process-groups/<uuid of PG> .  Grant Read and Write for your "group" and/or "user" to allow them to view configurations and added components (processors, controller services, child PGs, etc...) within this PG /data/process-groups/<uuid of PG> Granting Read and Write for your "group" and/or "user" to allow user to view and delete content (flowfiles) queued within connection within this PG. Keep in mind that child PGs will inherit the access granted to the parent PG unless explicit policies have been set on the child PG. Hope this helps, Matt ... View more

@HeathG  I'm happy to see you resolved your issue. Please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.  ... View more

@enirys  Can you once remove the problematic kerberos principal from FreeIPA and then try and regenerate the kerberos keytabs ipa-rmkeytab [ -p principal-name ] [ -k keytab-file ] [ -r realm ] [ -d ]   ... View more

I was seeing the same issue, thanks to @jakezhang  for posting.   Changing the Ranger KMS: kerberos_princ_name from rangerkms to keyadmin allowed me to get this working. Thanks for the clues in the log file and to @Scharan            ... View more

@Scharan   Appreciated your great help!   After adding ranger.plugin.kms.policy.rest.url :      Ranger KMS server started up ...    Thanks again!    Best regards, Jake Zhang   ... View more

I edited my solution above a bit.   We found that the issue was related to some kind of routing from Oozie WF to YARN logs. What we wanted was to view the logs from the Oozie WF manager.   When we access the logs from the YARN RM UI it works, but we couldn't able to view the logs directly from the Oozie WF manager. We already have the correct configurations present in the MapReduce service.   ... View more