[jira] [Created] (AMBARI-26620) LDAPS setup, sync, and login fail on Ambari 3.0.0 due to Python 3 encoding bugs and a Java 9+ module restriction

["Manish M Pillai (Jira)" <ji...@apache.org>]

Manish M Pillai created AMBARI-26620:
----------------------------------------

             Summary: LDAPS setup, sync, and login fail on Ambari 3.0.0 due to Python 3 encoding bugs and a Java 9+ module restriction
                 Key: AMBARI-26620
                 URL: https://issues.apache.org/jira/browse/AMBARI-26620
             Project: Ambari
          Issue Type: Bug
          Components: ambari-sever
    Affects Versions: 3.0.0
            Reporter: Manish M Pillai
            Assignee: Manish M Pillai


Setting up LDAPS end-to-end on Ambari 3.0.0 (Python 3, Java 9+) fails at three separate points in the flow — {{{}setup-ldap{}}}, {{{}sync-ldap{}}}, and LDAP login. All three block LDAP from working at all on a fresh 3.0.0 install running modern Python/Java, so they're reported together as they form one continuous blocker for the same feature (LDAP integration).
h3. Bug 1 — {{setup-ldap}} fails while saving configuration

*Where:* {{{}ambari_server/serverUtils.py{}}}, function {{perform_changes_via_rest_api()}}

*Cause:* The function builds the PUT/POST request body using {{{}json.dumps(){}}}, which returns a Python {{{}str{}}}. Python 3's {{urllib.request.urlopen()}} requires the request body to be {{{}bytes{}}}, so it raises a {{{}TypeError{}}}. Same root cause class as AMBARI-26062, but that fix only covered {{configs.py}} — this function was missed.

*Repro:* Run {{{}ambari-server setup-ldap -v{}}}, complete all prompts, confirm save.

*Exact error:*
{code:java}
Saving LDAP properties...
Traceback (most recent call last):
  File "/usr/sbin/ambari-server.py", line 1998, in <module>
    mainBody()
  File "/usr/sbin/ambari-server.py", line 1960, in mainBody
    main(options, args, parser)
  File "/usr/sbin/ambari-server.py", line 1902, in main
    action_obj.execute()
  File "/usr/sbin/ambari-server.py", line 131, in execute
    self.fn(*self.args, **self.kwargs)
  File "/usr/lib/ambari-server/lib/ambari_server/setupSecurity.py", line 1647, in setup_ldap
    admin_login, admin_password, properties, ldap_property_value_map
  File "/usr/lib/ambari-server/lib/ambari_server/setupSecurity.py", line 1315, in update_ldap_configuration
    properties, admin_login, admin_password, SETUP_LDAP_CONFIG_URL, "PUT", request_data
  File "/usr/lib/ambari-server/lib/ambari_server/serverUtils.py", line 269, in perform_changes_via_rest_api
    urllib.request.urlopen(request, context=get_ssl_context(properties))
  File "/usr/lib64/python3.6/urllib/request.py", line 223, in urlopen
    return opener.open(url, data, timeout)
  File "/usr/lib64/python3.6/urllib/request.py", line 524, in open
    req = meth(req)
  File "/usr/lib64/python3.6/urllib/request.py", line 1279, in do_request_
    raise TypeError(msg)
TypeError: POST data should be bytes, an iterable of bytes, or a file object. It cannot be of type str. {code}
h3. Bug 2 — {{sync-ldap}} fails during sync event creation

*Where:* {{{}ambari_server/setupSecurity.py{}}}, function {{sync_ldap()}}

*Cause:* Same encoding gap as Bug 1, in a different function that builds two separate REST request bodies for LDAP sync, neither encoded to bytes before being passed to {{{}urlopen(){}}}. Confirmed still present in current Ambari trunk as of July 2026 — not fixed upstream.

*Repro:* With {{setup-ldap}} working, run {{{}ambari-server sync-ldap --all{}}}.

*Exact error:*
{code:java}
Fetching LDAP configuration from DB.
Syncing all.ERROR: Exiting with exit code 1.
REASON: Sync event creation failed. Error details: POST data should be bytes, an iterable of bytes, or a file object. It cannot be of type str. {code}
h3. Bug 3 — LDAP login fails with Java module access error

*Where:* JVM startup args, {{ambari-env.sh}} ({{{}AMBARI_JVM_ARGS{}}})

*Cause:* Spring LDAP's {{AbstractContextSource}} reflectively accesses the JDK-internal class {{{}com.sun.jndi.ldap.LdapCtxFactory{}}}. Java 9+'s module system blocks this by default since {{java.naming}} does not export that package to unnamed modules. Ambari's default JVM args already include several {{--add-opens}} flags for {{java.base}} packages but are missing one for {{{}java.naming{}}}.

*Repro:* With Bugs 1 and 2 fixed, log in to the Ambari UI as a synced LDAP user, on Java 9+.

*Exact error:*
{code:java}
Caused by: java.lang.ExceptionInInitializerError: Exception java.lang.IllegalAccessError: class org.springframework.ldap.core.support.AbstractContextSource (in unnamed module @0x6a472554) cannot access class com.sun.jndi.ldap.LdapCtxFactory (in module java.naming) because module java.naming does not export com.sun.jndi.ldap to unnamed module @0x6a472554 [in thread "ambari-client-thread-29"]
        at org.springframework.ldap.core.support.AbstractContextSource.<clinit>(AbstractContextSource.java:77)
        at org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.loadLdapAuthenticationProvider(AmbariLdapAuthenticationProvider.java:166)
        at org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.authenticate(AmbariLdapAuthenticationProvider.java:91)
        ...
java.lang.NoClassDefFoundError: Could not initialize class org.springframework.ldap.core.support.LdapContextSource
        at org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.loadLdapAuthenticationProvider(AmbariLdapAuthenticationProvider.java:166)
        ... {code}
 

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ambari.apache.org
For additional commands, e-mail: issues-help@ambari.apache.org