Apache Ranger Audit log connect with Solr Cloud Mode with SSL

933 Views Asked by At

I have three nodes with Solr and ZooKeeper with enabled TLS/SSL where the ZK listen only in securePort and Solr - HTTPS.

Now I want to connect Solr to Apache Ranger for audit logs where I am setting:

ranger.audit.solr.urls = https://HOST1:8983/solr/ranger_audits

and

ranger_admin_solr_zookeepers = HOST1:2281,HOST2:2281,HOST3:2281

The Apache Ranger is not in SSL mode and listen only on HTTP.

For Solr I have successfully create ranger_audits configset and collection with the same name. ZooKeeper election is also successful where I have 1 leader and 2 followers.

So everything works as expected except the Apache Ranger audit communication. The version of the Apache Ranger is 2.0. ZooKeeper version - 3.6.3 Solr version - 8.11.1

With the current settings I get the following exception when open audit tab in Ranger UI:

2022-03-22 06:54:08,189 [http-bio-6080-exec-2] INFO  org.apache.ranger.common.RESTErrorUtil (RESTErrorUtil.java:326) - Operation error. response=VXResponse={org.apache.ranger.view.VXResponse@7ef95c52statusCode={1} msgDesc={Error running solr query, please check solr configs. java.util.concurrent.TimeoutException: Could not connect to ZooKeeper HOST1:2281,HOST2:2281,HOST3:2281 within 15000 ms} messageList={[VXMessage={org.apache.ranger.view.VXMessage@3bd495a3name={ERROR_SYSTEM} rbKey={xa.error.system} message={System Error. Please try later.} objectId={null} fieldName={null} }]} }
javax.ws.rs.WebApplicationException

UPDATE:

The solution is to provide jaas.conf and java properties which fixed the problem.

-Dzookeeper.client.secure=true 
-Djava.security.auth.login.config=/etc/ranger/admin/conf/jaas.conf 

The sample of the jaas.conf is:

Client {
   org.apache.zookeeper.server.auth.DigestLoginModule required
   username="admin"
   password="admin-pass";
};

Please note that this is not complete solution and the connection from Ranger to through HTTPS ZooKeepers is still problematic.

0

There are 0 best solutions below