ambari-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Sumit Mohanty (JIRA)" <j...@apache.org>
Subject [jira] [Created] (AMBARI-19642) Error during Alert: Unable to authenticate through LDAP for Hiveserver2 (also floods HS2 log with error messages)
Date Fri, 20 Jan 2017 06:39:26 GMT
Sumit Mohanty created AMBARI-19642:
--------------------------------------

             Summary: Error during Alert: Unable to authenticate through LDAP for Hiveserver2
(also floods HS2 log with error messages)
                 Key: AMBARI-19642
                 URL: https://issues.apache.org/jira/browse/AMBARI-19642
             Project: Ambari
          Issue Type: Bug
          Components: stacks
    Affects Versions: 2.5.0
            Reporter: Sumit Mohanty
            Assignee: Sumit Mohanty
            Priority: Critical
             Fix For: 2.5.0


Ambari Alert can't authenticate through LDAP for HiveServer2 using the ambari-qa user because
there's no where set the ambari-qa password.

javax.security.sasl.SaslException: Error validating the login [Caused by javax.security.sasl.AuthenticationException:
Error validating LDAP user [Caused by javax.naming.Authentic 
ationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903C8, comment: AcceptSecurityContext
error, data 52e, v2580 
at org.apache.hive.service.auth.PlainSaslServer.evaluateResponse(PlainSaslServer.java:109)

at org.apache.thrift.transport.TSaslTransport$SaslParticipant.evaluateChallengeOrResponse(TSaslTransport.java:509)

at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:264) 
at org.apache.thrift.transport.TSaslServerTransport.open(TSaslServerTransport.java:41) 
at org.apache.thrift.transport.TSaslServerTransport$Factory.getTransport(TSaslServerTransport.java:216)

at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:189)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) 
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) 
at java.lang.Thread.run(Thread.java:744) 
Caused by: javax.security.sasl.AuthenticationException: Error validating LDAP user [Caused
by javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID 
-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580 
at org.apache.hive.service.auth.LdapAuthenticationProviderImpl.Authenticate(LdapAuthenticationProviderImpl.java:70)

at org.apache.hive.service.auth.PlainSaslHelper$PlainServerCallbackHandler.handle(PlainSaslHelper.java:106)

at org.apache.hive.service.auth.PlainSaslServer.evaluateResponse(PlainSaslServer.java:102)

... 8 more 
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr:
DSID-0C0903C8, comment: AcceptSecurityContext error, data 52e, v2580 
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3087) 
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3033) 
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2835) 
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749) 
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:316) 
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193) 
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211) 
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154) 
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84) 
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684) 
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307) 
at javax.naming.InitialContext.init(InitialContext.java:242) 
at javax.naming.InitialContext.<init>(InitialContext.java:216) 
at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101) 
at org.apache.hive.service.auth.LdapAuthenticationProviderImpl.Authenticate(LdapAuthenticationProviderImpl.java:67)

... 10 more 
2014-12-29 00:00:12,532 ERROR server.TThreadPoolServer (TThreadPoolServer.java:run(215)) -
Error occurred during processing of message. 
java.lang.RuntimeException: org.apache.thrift.transport.TTransportException: Error validating
the login 
at org.apache.thrift.transport.TSaslServerTransport$Factory.getTransport(TSaslServerTransport.java:219)

at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:189)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) 
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) 
at java.lang.Thread.run(Thread.java:744) 
Caused by: org.apache.thrift.transport.TTransportException: Error validating the login 
at org.apache.thrift.transport.TSaslTransport.sendAndThrowMessage(TSaslTransport.java:221)

at org.apache.thrift.transport.TSaslTransport.open(TSaslTransport.java:297) 
at org.apache.thrift.transport.TSaslServerTransport.open(TSaslServerTransport.java:41) 
at org.apache.thrift.transport.TSaslServerTransport$Factory.getTransport(TSaslServerTransport.java:216)

... 4 more

**LDAP doesn't except blank passwords**


It is expected that ambari-qa user able to authenticate through LDAP for HiveServer2

ANALYSIS:

1) We found when hive.server2.authentication=LDAP, the HiveServer2 log will show the LDAP
error once Alert is turned on. 

2) Alert uses check_tcp_wrapper_sasl!10000!LDAP!! 

3) When hive.server2.authentication=NONE, we don't get the Alert LDAP error for HiveServer2.


or 

1) If we run "beeline" and !connect jdbc:hive2://<hiveserver2_server>:10000 -n ambari-qa",
we will get the LDAP error too.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message