ranger常见问题

1、创建库表指定手动指定location无权限

报错示例

 FAILED: HiveAccessControlException Permission denied: user [hive] does not have [ALL] privilege on [hdfs://extDev/hive/warehouse] (state=42000,code=40000)

hdfs://extDev/hive/warehouse这个位置为临时指定

原因分析

结合大佬文章及代码，是因为ranger在创建库时会检查location的目录属主，只有属主通过才会校验是否有其他权限。不然无法通过鉴权，报hdfs权限问题。
如果报错user [hive] does not have [ALL] privilege on ，基本都是属主不通过

解决办法

• 手动授权location 目录为当前用户属主
• 修改ranger鉴权代码逻辑，不检查属主权限

2、建立hive service时无法连接问题

报错示例

org.apache.ranger.plugin.client.HadoopException: Unable to connect to Hive Thrift Server instance.. 
Unable to connect to Hive Thrift Server instance.. 
Could not open client transport for any of the Server URI's in ZooKeeper: Could not establish connection to jdbc:hive2://c2bde55:10000/;serviceDiscoveryMode=zooKeeper;zooKeeperNamespace=hiveserver2: Required field 'client_protocol' is unset! Struct:TOpenSessionReq(client_protocol:null, configuration:{use:database=default}). 
Could not establish connection to jdbc:hive2://c2bde55:10000/;serviceDiscoveryMode=zooKeeper;zooKeeperNamespace=hiveserver2: Required field 'client_protocol' is unset! Struct:TOpenSessionReq(client_protocol:null, configuration:{use:database=default}). 
Required field 'client_protocol' is unset! Struct:TOpenSessionReq(client_protocol:null, configuration:{use:database=default}). 

原因

原因是hive相关jar包不匹配问题

解决

cd $RANGER_ADMIN_HOME/ews/webapp/WEB-INF/classes/ranger-plugins/
cp -r hive hive.bak
cd hive
ls | grep ^hive | awk -F"-" '{print $1"-"$2}' | xargs -i{} bash -C "\cp $HIVE_HOME/lib/{}* ./"    #强制覆盖当前目录的hive 依赖包，如果字符不是两个的会有问题，可以手动cp过来

3、安装ranger-admin sql执行失败

配置完成后执行./setup.sh 脚本遇到问题，执行失败。手动执行报外建无法删除

/usr/local/java/bin/java  -cp /usr/share/java/mysql-connector-java.jar:/home/tianzehao/ranger/ranger-2.2.0-SNAPSHOT-admin/jisql/lib/* org.apache.util.sql.Jisql -driver mysqlconj -cstring jdbc:mysql://sfcloud-bsm-ext-dev-01.sf.cloud.com/ranger_db_proxy -u 'ranger' -p 'mGi7pXpUW6Ke' -noheader -trim -c \; -input /home/tianzehao/ranger/ranger-2.2.0-SNAPSHOT-admin/db/mysql/optimized/current/ranger_core_db_mysql.sql 

解决

手动删除整个ranger_db重新安装

4、安装ranger-admin时mysql配置文件读取文件错误

    er$WarnLogger (Slf4jMLog.java:220) - com.mchange.v2.async.ThreadPoolAsynchronousRunner$DeadlockDetector@4a9c943 -- APPARENT DEADLOCK!!! Complete Status: 
            Managed Threads: 3
            Active Threads: 3
            Active Tasks: 
                    com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask@2b7cd2d2
                            on thread: C3P0PooledConnectionPoolManager[identityToken->2zrqx9app8hioh1qkv7lj|6caf935d]-HelperThread-#0
                    com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask@7ae430e6
                            on thread: C3P0PooledConnectionPoolManager[identityToken->2zrqx9app8hioh1qkv7lj|6caf935d]-HelperThread-#1
                    com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask@12c9f0db
                            on thread: C3P0PooledConnectionPoolManager[identityToken->2zrqx9app8hioh1qkv7lj|6caf935d]-HelperThread-#2
            Pending Tasks: 
                    com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask@6295a9dd
                    com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask@2f320d1f
    Pool thread stack traces:
            Thread[C3P0PooledConnectionPoolManager[identityToken->2zrqx9app8hioh1qkv7lj|6caf935d]-HelperThread-#0,5,main]
                    java.net.PlainSocketImpl.socketConnect(Native Method)
                    java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:476)
                    java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:218)
                    java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:200)
                    java.net.SocksSocketImpl.connect(SocksSocketImpl.java:394)
                    java.net.Socket.connect(Socket.java:606)
                    java.net.Socket.connect(Socket.java:555)
                    java.net.Socket.<init>(Socket.java:451)
                    java.net.Socket.<init>(Socket.java:261)
                    com.mysql.jdbc.StandardSocketFactory.connect(StandardSocketFactory.java:258)
                    com.mysql.jdbc.MysqlIO.<init>(MysqlIO.java:306)
                    com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2504)
                    com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2541)
                    com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2323)
                    com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:832)
                    com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:46)
                    sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

原因分析

读取日志发现配置文件读取的是classs下的不是，classes/conf下的，我们再install.properties配置文件中的信息执行安装脚本时会生成到conf/ranger-admin-site.xml文件，不是classes下的。删除重启会

image.png