You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@storm.apache.org by prakash r <rp...@gmail.com> on 2018/01/11 21:51:52 UTC
Ranger Authorization fails for storm kerberos, after disabling HTTP authentication
Hello All,
We have configured Ranger plugin for Storm authorization and its kerberos
cluster.
We have disabled by HTTP authentication, by changing the configuration
ui.filter as null
We can able to view the UI, but if we send any request request like
getTopology, its failing (as the user is considered as null)
*Curl Output :*
HTTP/1.1 500 Server Error
Date: Thu, 11 Jan 2018 21:42:45 GMT
Cache-Control: no-cache, no-store
Content-Type: application/json;charset=utf-8
Content-Length: 5459
Server: Jetty(7.x.y-SNAPSHOT)
{"error":"Internal Server
Error","errorMessage":"AuthorizationException(msg:UI request 'getTopology'
for 'unknown' user is not authorized)\n\tat
org.apache.storm.ui.core$assert_authorized_user.invoke(core.clj:109)\n\tat
org.apache.storm.ui.core$fn__10090.invoke(core.clj:1060)
*Storm Log :*
2018-01-12 08:42:45.723 o.a.r.a.s.a.RangerStormAuthorizer qtp192318053-37
[INFO] NULL User found from principal [null]: Skipping authorization;
allowedFlag => [false], Audit Enabled:false
2018-01-12 08:42:45.723 o.a.r.a.s.a.RangerStormAuthorizer qtp192318053-37
[DEBUG] [req 4] Access from: [null] user: [null], op:
[getTopology],topology: [crowdstrike] => returns [false], Audit
Enabled:false
2018-01-12 08:42:45.723 o.a.r.p.c.RangerPluginClassLoader qtp192318053-37
[DEBUG] ==> RangerPluginClassLoader.deactivate()
2018-01-12 08:42:45.723 o.a.r.p.c.RangerPluginClassLoader qtp192318053-37
[DEBUG] <== RangerPluginClassLoader.deactivate()
2018-01-12 08:42:45.723 o.a.r.a.s.a.RangerStormAuthorizer qtp192318053-37
[DEBUG] <== RangerStormAuthorizer.permit()
2018-01-12 08:42:45.724 o.a.s.s.o.e.j.s.Server qtp192318053-37 [DEBUG]
RESPONSE /api/v1/topology/crowdstrike-2-1508896804 500 handled=true
If we configure ui.filter:
"org.apache.hadoop.security.authentication.server.AuthenticationFilter"
The curl output is as expected, we dont get any authorization failure.
We want to disable UI authentication.
Are we doing any mistake over here, is there anyway to avoid this issue,
please suggest, thanks
Regards,
Prakash R
Re: Ranger Authorization fails for storm kerberos, after disabling
HTTP authentication
Posted by prakash r <rp...@gmail.com>.
Hello All,
Any suggestion on how to disable HTTP authentication for Kerberosed storm
cluster, thanks
Regards,
Prakash R
On Fri, Jan 12, 2018 at 8:51 AM, prakash r <rp...@gmail.com> wrote:
> Hello All,
>
> We have configured Ranger plugin for Storm authorization and its kerberos
> cluster.
>
> We have disabled by HTTP authentication, by changing the configuration
> ui.filter as null
>
> We can able to view the UI, but if we send any request request like
> getTopology, its failing (as the user is considered as null)
>
> *Curl Output :*
>
> HTTP/1.1 500 Server Error
> Date: Thu, 11 Jan 2018 21:42:45 GMT
> Cache-Control: no-cache, no-store
> Content-Type: application/json;charset=utf-8
> Content-Length: 5459
> Server: Jetty(7.x.y-SNAPSHOT)
>
> {"error":"Internal Server Error","errorMessage":"AuthorizationException(msg:UI
> request 'getTopology' for 'unknown' user is not authorized)\n\tat
> org.apache.storm.ui.core$assert_authorized_user.invoke(core.clj:109)\n\tat
> org.apache.storm.ui.core$fn__10090.invoke(core.clj:1060)
>
>
> *Storm Log :*
>
> 2018-01-12 08:42:45.723 o.a.r.a.s.a.RangerStormAuthorizer qtp192318053-37
> [INFO] NULL User found from principal [null]: Skipping authorization;
> allowedFlag => [false], Audit Enabled:false
> 2018-01-12 08:42:45.723 o.a.r.a.s.a.RangerStormAuthorizer qtp192318053-37
> [DEBUG] [req 4] Access from: [null] user: [null], op:
> [getTopology],topology: [crowdstrike] => returns [false], Audit
> Enabled:false
> 2018-01-12 08:42:45.723 o.a.r.p.c.RangerPluginClassLoader qtp192318053-37
> [DEBUG] ==> RangerPluginClassLoader.deactivate()
> 2018-01-12 08:42:45.723 o.a.r.p.c.RangerPluginClassLoader qtp192318053-37
> [DEBUG] <== RangerPluginClassLoader.deactivate()
> 2018-01-12 08:42:45.723 o.a.r.a.s.a.RangerStormAuthorizer qtp192318053-37
> [DEBUG] <== RangerStormAuthorizer.permit()
> 2018-01-12 08:42:45.724 o.a.s.s.o.e.j.s.Server qtp192318053-37 [DEBUG]
> RESPONSE /api/v1/topology/crowdstrike-2-1508896804 500 handled=true
>
>
>
> If we configure ui.filter: "org.apache.hadoop.security.
> authentication.server.AuthenticationFilter"
>
> The curl output is as expected, we dont get any authorization failure.
>
> We want to disable UI authentication.
>
> Are we doing any mistake over here, is there anyway to avoid this issue,
> please suggest, thanks
>
>
> Regards,
> Prakash R
>