Hi all I have hdp 2.6.3 with ranger security ssl enabled and plugins(hdfs, yarn and hive) enabled hive plugin not works here is hiveserver2.log: 2018-02-16 17:34:00,920 WARN [Thread-14]: client.RangerAdminRESTClient (RangerAdminRESTClient.java:getServicePoliciesIfUpdated(162)) - Error getting policies. secureMode=false, user=hive (auth:SIMPLE), response={"httpStatusCode":400,"statusCode":0}, serviceName=hive and /var/log/ranger/admin/xa_portal.log: 2018-02-16 08:27:59,754 [http-bio-6182-exec-28] ERROR org.apache.ranger.common.ServiceUtil (ServiceUtil.java:1359) - Requested Service not found. serviceName=hive I am almost 99% sure that all configurations have done correctly from ambari(because other plugins are working properly), also searched on google wondering what I have missed, but was not able to find useful information P.S. I have configured ranger.plugin.hive.policy.rest.ssl.config.file = /usr/hdp/current/hive-client/conf/conf.server/ranger-policymgr-ssl.xml which conatins all information about keystores and truststores, also I am sure that keystore file passwords are correct(checked many times) here is the file ranger-policymgr-ssl.xml <configuration> <property> <name>xasecure.policymgr.clientssl.keystore</name> <value>/etc/security/key.jks</value> </property> <property> <name>xasecure.policymgr.clientssl.keystore.credential.file</name> <value>jceks://file/etc/ranger/hive/cred.jceks</value> </property> <property> <name>xasecure.policymgr.clientssl.keystore.password</name> <value>crypted</value> </property> <property> <name>xasecure.policymgr.clientssl.truststore</name> <value>/etc/security/trust.jks</value> </property> <property> <name>xasecure.policymgr.clientssl.truststore.credential.file</name> <value>jceks://file/etc/ranger/hive/cred.jceks</value> </property> <property> <name>xasecure.policymgr.clientssl.truststore.password</name> <value>crypted</value> </property> do you have any idea what I miss and how can I fix this? Thank you ... View more

Hi all I am trying figure out knox gateway but I have problem when I access services like WEBHDFS this is error log from /var/log/knox/gateway-audit.log: 17/12/28 21:30:30 ||de5c4e70-c89c-487e-8fea-6260c6701efb|audit|IPADDR|WEBHDFS||||access|uri|/gateway/default/webhdfs/v1|unavailable|Request method: GET 17/12/28 21:30:30 ||de5c4e70-c89c-487e-8fea-6260c6701efb|audit|IPADDR|WEBHDFS||||access|uri|/gateway/default/webhdfs/v1|success|Response status: 401 this is my topology configuration: <topology> <gateway> <provider> <role>authentication</role> <name>ShiroProvider</name> <enabled>true</enabled> <param> <name>sessionTimeout</name> <value>15</value> </param> <param> <name>main.ldapRealm</name> <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapRealm</value> </param> <param> <name>main.ldapContextFactory</name> <value>org.apache.hadoop.gateway.shirorealm.KnoxLdapContextFactory</value> </param> <param> <name>main.ldapRealm.contextFactory</name> <value>$ldapContextFactory</value> </param> <param> <name>main.ldapRealm.contextFactory.url</name> <value>ldap://ragaca.com:389</value> </param> <param> <name>main.ldapRealm.authorizationEnabled</name> <value>true</value> </param> <param> <name>main.ldapRealm.contextFactory.authenticationMechanism</name> <value>simple</value> </param> <param> <name>main.ldapRealm.userDnTemplate</name> <value>sAMAccountName={0}</value> </param> <param> <name>main.ldapRealm.userSearchAttributeName</name> <value>sAMAccountName</value> </param> <param> <name>main.ldapRealm.userObjectClass</name> <value>person</value> </param> <param> <name>main.ldapRealm.contextFactory.systemUsername</name> <value>CN=testUser,OU=testUsers,DC=ragaca,DC=com</value> </param> <param> <name>main.ldapRealm.contextFactory.systemPassword</name> <value>*********</value> </param> <param> <name>main.ldapRealm.searchBase</name> <value>OU=Domain Users & Groups,DC=ragaca,DC=com</value> </param> <param> <name>main.ldapRealm.userSearchBase</name> <value>Users,OU=Domain Users & Groups,DC=ragaca,DC=com</value> </param> <param> <name>main.ldapRealm.userSearchScope</name> <value>subtree</value> </param> <param> <name>main.ldapRealm.groupSearchBase</name> <value>OU=Groups,OU=Domain Users & Groups,DC=ragaca,DC=com</value> </param> <param> <name>main.ldapRealm.groupObjectClass</name> <value>group</value> </param> <param> <name>main.ldapRealm.memberAttribute</name> <value>member</value> </param> <param> <name>urls./**</name> <value>authcBasic</value> </param> </provider> <provider> <role>identity-assertion</role> <name>Default</name> <enabled>true</enabled> </provider> <provider> <role>authorization</role> <name>AclsAuthz</name> <enabled>true</enabled> </provider> </gateway> <service> <role>NAMENODE</role> <url>hdfs://namenode1.ragaca.com:8020</url> </service> <service> <role>JOBTRACKER</role> <url>rpc://jt.ragaca.com:8050</url> </service> <service> <role>WEBHDFS</role> <url>http://namenode1.ragaca.com:50070/</url> <url>http://namenode2.ragaca.com:50070/</url> </service> </topology> I also have hadoop.proxyuser.knox.hosts=* and hadoop.proxyuser.knox.groups=* in the core-site of the HDFS configuration could anyone guess what am I missing Thank you very much and happy new year ... View more