Community Articles

KuldeepK · ‎06-19-2017

These steps have been successfully tried and tested on Ambari-2.4.2.0 and HDP-2.5.3.

.

When you install and configure Solr cloud via Ambari or embedded solr via Ambari Infra on a kerberized cluster, SPNEGO authentication gets enabled by default. There is not direct switch to disable only SPNEGO authentication.

.

Please follow below method to disable it.

.

Step 1 - Login to Ambari server

.

Step 2 - Please take backup of below script

/var/lib/ambari-server/resources/common-services/SOLR/<version>/package/scripts/setup_solr_kerberos_auth.py

.

Step 3 - Edit above script and do the modifications as below

Original value:

command += '\'{"authentication":{"class": "org.apache.solr.security.KerberosPlugin"}}\''

Recommended value:

command += '\'{ }\''

.

Step 4 - Please replace cached script with below command and restart ambari-agent followed by Solr service(via Ambari)

cp /var/lib/ambari-server/resources/mpacks/solr-ambari-mpack-5.5.2.2.5/common-services/SOLR/5.5.2.2.5/package/scripts/setup_solr_kerberos_auth.py /var/lib/ambari-agent/cache/common-services/SOLR/5.5.2.2.5/package/scripts/setup_solr_kerberos_auth.py

.

You should be able to access Solr Web UI without having kerberos ticket.

.

Please comment if you have any feedback/questions/suggestions. Happy Hadooping!!

anrathen · ‎07-21-2017

Thanks for the instructions. I have a Kerberos and HTTPS HDP 2.5 cluster, and after Kerberizing, I see errors in the Ambari infra logs of both the nodes that it could not replicate the index between the solr nodes. Is this related to the above steps?

**Note: I am able to access the Solr UI of both the Ambari infra solr nodes, though.

Errors:

	ERROR [c:hadoop_logs s:shard3 r:core_node1 x:hadoop_logs_shard3_replica1] org.apache.solr.update.StreamingSolrClients$1 (StreamingSolrClients.java:79) - error

	org.apache.solr.common.SolrException: Authentication required

and when I restart the Ambari-Infra solr services, I do see the below error as well:

	Expected mime type application/octet-stream but got text/html. <html>
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
	<title>Error 401 Authentication required</title>
	</head>
	<body><h2>HTTP ERROR 401</h2>
	<p>Problem accessing /solr/vertex_index_shard1_replica1/get. Reason:
	<pre>  Authentication required</pre></p><hr><i><small>Powered by Jetty://</small></i><hr/>
	</body>
	</html>

Any inputs on how to resolve this?

Recently, I updated the LogSearch UI to HTTPS and that is unable to connect to the Solr instances ..

Thanks in advance.

anil_gurijala1 · ‎08-16-2017

Hi Kuldeep, Thanks for the information. I applied the same steps for HDP 2.6. But, the SPNEGO is still enabled. One thing I observed is that there was no SOLR in the cached script. I created the SOLR directory and subsequent path and copied the modified script. Do you think that's the reason. Any help in this regard is appreciated.

misterbaanu · ‎08-22-2017

Thank You. I was strucked at this point for past one day.

misterbaanu · ‎08-22-2017

Thank You. I was strucked at this point for past one day.

arunpoy · ‎10-05-2017

Hi Kuldeep, thanks for this hack. IS there a similar hack that can be applied to schema registry too?

Moka · ‎02-21-2019

I see this is very old post, can we have any property which can be set for solr 7.4 in HDP 3.0.1 to disable spnego authentication?

Please help, we are stuck at this step and not able to access the solr URL getting below error.

HTTP ERROR 403

Problem accessing /solr/. Reason:

    GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)

AkshayZ · ‎05-20-2020

@Moka Have you resolved your issue? What steps did you followed?

Cloudera Community

Community Articles

How to disable SPNEGO authentication for Solr

Apache Ambari

Apache Solr

These steps have been successfully tried and tested on Ambari-2.4.2.0 and HDP-2.5.3.

When you install and configure Solr cloud via Ambari or embedded solr via Ambari Infra on a kerberized cluster, SPNEGO authentication gets enabled by default. There is not direct switch to disable only SPNEGO authentication.

Please follow below method to disable it.

Step 1 - Login to Ambari server

Step 2 - Please take backup of below script

Step 3 - Edit above script and do the modifications as below

Step 4 - Please replace cached script with below command and restart ambari-agent followed by Solr service(via Ambari)

You should be able to access Solr Web UI without having kerberos ticket.

Please comment if you have any feedback/questions/suggestions. Happy Hadooping!!

Re: How to disable SPNEGO authentication for Solr

Re: How to disable SPNEGO authentication for Solr

Re: How to disable SPNEGO authentication for Solr

Re: How to disable SPNEGO authentication for Solr

Re: How to disable SPNEGO authentication for Solr

Re: How to disable SPNEGO authentication for Solr

HTTP ERROR 403

Re: How to disable SPNEGO authentication for Solr