You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@impala.apache.org by "Tim Armstrong (Jira)" <ji...@apache.org> on 2020/05/14 18:52:00 UTC
[jira] [Resolved] (IMPALA-6770) Catalog service should retry
connecting to Sentry similar to HMS
[ https://issues.apache.org/jira/browse/IMPALA-6770?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tim Armstrong resolved IMPALA-6770.
-----------------------------------
Resolution: Won't Fix
Sentry support is being removed
> Catalog service should retry connecting to Sentry similar to HMS
> ----------------------------------------------------------------
>
> Key: IMPALA-6770
> URL: https://issues.apache.org/jira/browse/IMPALA-6770
> Project: IMPALA
> Issue Type: Improvement
> Components: Catalog
> Affects Versions: Impala 2.12.0
> Reporter: Mostafa Mokhtar
> Assignee: Vuk Ercegovac
> Priority: Major
>
> If the Catalog service fails to connect to Sentry at startup it doesn't retry, if the Sentry service becomes available later on the Catalog needs a restart to connect.
> {code}
> 0329 12:08:21.547955 128362 RetryClientInvocationHandler.java:99] failed to execute listRoles
> Java exception follows:
> java.lang.reflect.InvocationTargetException
> at sun.reflect.GeneratedMethodAccessor12.invoke(Unknown Source)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:498)
> at sentry.org.apache.sentry.core.common.transport.RetryClientInvocationHandler.invokeImpl(RetryClientInvocationHandler.java:95)
> at sentry.org.apache.sentry.core.common.transport.SentryClientInvocationHandler.invoke(SentryClientInvocationHandler.java:41)
> at com.sun.proxy.$Proxy14.listRoles(Unknown Source)
> at org.apache.impala.util.SentryPolicyService.listAllRoles(SentryPolicyService.java:393)
> at org.apache.impala.util.SentryProxy.checkUserSentryAdmin(SentryProxy.java:215)
> at org.apache.impala.service.JniCatalog.checkUserSentryAdmin(JniCatalog.java:259)
> Caused by: org.apache.sentry.provider.db.SentryAccessDeniedException: Access denied to foo. Server Stacktrace: org.apache.sentry.provider.db.SentryAccessDeniedException: Access denied to foo
> at org.apache.sentry.provider.db.service.thrift.SentryPolicyStoreProcessor.list_sentry_roles_by_group(SentryPolicyStoreProcessor.java:581)
> at org.apache.sentry.provider.db.service.thrift.SentryPolicyService$Processor$list_sentry_roles_by_group.getResult(SentryPolicyService.java:1077)
> at org.apache.sentry.provider.db.service.thrift.SentryPolicyService$Processor$list_sentry_roles_by_group.getResult(SentryPolicyService.java:1062)
> at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39)
> at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39)
> at org.apache.sentry.provider.db.service.thrift.SentryProcessorWrapper.process(SentryProcessorWrapper.java:36)
> at org.apache.thrift.TMultiplexedProcessor.process(TMultiplexedProcessor.java:123)
> at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:286)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)
> at org.apache.sentry.service.thrift.Status.throwIfNotOk(Status.java:113)
> at org.apache.sentry.provider.db.service.thrift.SentryPolicyServiceClientDefaultImpl.listRolesByGroupName(SentryPolicyServiceClientDefaultImpl.java:161)
> at org.apache.sentry.provider.db.service.thrift.SentryPolicyServiceClientDefaultImpl.listRoles(SentryPolicyServiceClientDefaultImpl.java:207)
> ... 9 more
> I0329 12:08:21.549322 128362 jni-util.cc:230] org.apache.impala.catalog.AuthorizationException: User 'foo@foo.COM' does not have privileges to access the requested policy metadata or Sentry Service is unavailable.
> at org.apache.impala.util.SentryProxy.checkUserSentryAdmin(SentryProxy.java:217)
> at org.apache.impala.service.JniCatalog.checkUserSentryAdmin(JniCatalog.java:259)
> I0329 12:08:21.559258 128362 status.cc:125] AuthorizationException: User 'foo@foo.COM' does not have privileges to access the requested policy metadata or Sentry Service is unavailable.
> @ 0x965c1a impala::Status::Status()
> @ 0xcec82d impala::JniUtil::GetJniExceptionMsg()
> @ 0x956afd impala::Catalog::SentryAdminCheck()
> @ 0x9490dc CatalogServiceThriftIf::SentryAdminCheck()
> @ 0x9fb17e impala::CatalogServiceProcessor::process_SentryAdminCheck()
> @ 0x9fa3ff impala::CatalogServiceProcessor::dispatchCall()
> @ 0x933a0a apache::thrift::TDispatchProcessor::process()
> @ 0xb17949 apache::thrift::server::TAcceptQueueServer::Task::run()
> @ 0xb100c9 impala::ThriftThread::RunRunnable()
> @ 0xb10ec2 boost::detail::function::void_function_obj_invoker0<>::invoke()
> @ 0xd5f40f impala::Thread::SuperviseThread()
> @ 0xd5fc0a boost::detail::thread_data<>::run()
> @ 0x12d64fa (unknown)
> @ 0x7f3027e34dc5 start_thread
> @ 0x7f3027b61ced __clone
> E0329 12:08:21.559299 128362 catalog-server.cc:145] AuthorizationException: User 'foo@foo.COM' does not have privileges to access the requested policy metadata or Sentry Service is unavailable.
> {code}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)