Error stack contains: HTTP Status 403, Message: Forbidden no much details further. ... View more

Hello Jagadeesan, The cluster are not multi homed the TIME Line server is providing the required DT . The issue is specific to kms delegation token. Can you please confirm if this is a known issue. I have verified the below as well. https://community.hortonworks.com/content/supportkb/154246/error-orgapachehadoopyarnexceptionsyarnexception-f.html ... View more

@Nixon Rodrigues The problem was with the initial import where atlas user doesn't have read/execute on /apps/hive/warehouse. Once I added the policy for atlas user and ran the script, I was able to get everything in place. ... View more

@Geoffrey Shelton Okot The authorizer class is set to simpleAuthorizer* and why should I have the ranger plugin for kafka enabled ? ... View more

@Josh Elser Can you help me out. Not sure what it means insufficient permissions. are you referring to the SYSTEM namespace ? I am trying to launch a session using pheonix-sqlline with a under privileged user who has read permission on the ALL the namespaces and tables typically added the public group to the default policy in Ranger. 2. When a user makes the first connection to Phoenix (instantiates the JDBC driver) it will check and try to create the SYSTEM tables if they don't already exist. For all but the first connection, this will be a no-op. If you have permissions put in place, you will want to launch sqlline (or some application using Phoenix) which has the permission to create these SYSTEM tables. Then, before having unprivileged users access phoenix, make sure they have read permission on the system tables. as per above my understanding is any user needs to have full permissions on the system tables while connecting to sqlline for the first time and then just granting read access on the system tables should help him re-establish the session. Also can you please point me to document that can provide information around restricting access via Ranger for Phoenix. ... View more

@Josh Elser I have followed the above steps,but, have problem when I revoke the write and create permissions for the user post first login. Env: HDP 2.6 Enabled phoenix.schema.isNamespaceMappingEnabled Kerberos and Ranger Hbase plugin enabled. Post Enabling the property: 1) Added the user to default policy which enables all permissions. 2) login using phoenix-sqlline zookeeper-quorum:2181:/hbase-secure got connected without any issue. 3) logged out and removed the WCA from Ranger policy. Below is the error. Caused by: org.apache.hadoop.hbase.ipc.RemoteWithExtrasException(org.apache.hadoop.hbase.security.AccessDeniedException): org.apache.hadoop.hbase.security.AccessDeniedException: Insufficient permissions for user ‘user@REALM',action: put, tableName:SYSTEM:CATALOG, family:0, column: _0 at org.apache.ranger.authorization.hbase.RangerAuthorizationCoprocessor.requirePermission(RangerAuthorizationCoprocessor.java:551) ... View more

@Geoffrey Shelton, thanks for the document. I am familiar with the auth to local rules and all our custom rules are also working fine. The problem here is with the ambari script that generated the keytabs with principal name as lower case i.e. spark-cluster instead of spark-CLUSTER that is causing the issue. ... View more