Why can't Impala-shell log in to LDAP even though the code is successful?

107 Views Asked by At

I'm using CDH Impala and configure a ldap in impala. I try to log in ldap using impala-shell. impala version : 3.2.0v

impala-shell -l --auth_creds_ok_in_clear -u viewer

Login was failed and error log was like this.

I0530 13:18:09.610710  2147 authentication.cc:254] Trying simple LDAP bind for: uid=viewer,ou=users,dc=...,dc=...
W0530 13:18:09.615681  2147 authentication.cc:261] LDAP authentication failure for uid=viewer,ou=users,dc=...,dc=... : Can't contact LDAP server
E0530 13:18:09.615723  2147 authentication.cc:164] SASL message (LDAP): Password verification failed
I0530 13:18:09.615808  2147 thrift-util.cc:123] TAcceptQueueServer: Caught TException: SASL(-13): user not found: Password verification failed

At the same time, the ldap log was like this.

slapd[35938]: conn=1022 fd=13 ACCEPT from IP=10.161.102.70:46408 (IP=0.0.0.0:636)
slapd[35938]: conn=1022 fd=13 TLS established tls_ssf=256 ssf=256
slapd[35938]: conn=1022 fd=13 closed (connection lost)

The weird this was that when i copied the impala's code and tested it, it was successful. Code is this. (https://github.com/apache/impala/blob/branch-3.2.0/be/src/rpc/authentication.cc)

#include <iostream>
#include <string>
#include <ldap.h>
#include <lber.h>

using namespace std;

int main() {

    LDAP* ld;
    const char *ldapUri = "ldaps://10.161.102.61:636";
    int rc = ldap_initialize(&ld, ldapUri);

    if (rc != LDAP_SUCCESS) {
        cout << "LDAP Initailization failed " << ldap_err2string(rc);
        return 1;
    }

    cout << "PASS : Initailization" << "\n";

    int ldap_ver = 3;
    ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &ldap_ver);

    bool FLAGS_ldap_tls = false;
    if (FLAGS_ldap_tls) {
        int tls_rc = ldap_start_tls_s(ld, NULL, NULL);
        if (tls_rc != LDAP_SUCCESS) {
            cout << "Could not start TLS secure connection to LDAP server, " << "Error: " << ldap_err2string(tls_rc);
            ldap_unbind_ext(ld, NULL, NULL);
            return 1;
        }
    }

    string user = "uid=viewer,ou=users,dc=...,dc=...";
    //string user = "";
    const char *password = "...";
    struct berval pass = {
            strlen(password),
            (char *) password
    };

    rc = ldap_sasl_bind_s(
            ld,
            user.c_str(),
            LDAP_SASL_SIMPLE,
            &pass,
            NULL, NULL, NULL);
    ldap_unbind_ext(ld, NULL, NULL);
    if (rc != LDAP_SUCCESS) {
        cout << "FAILED LDAP contact" << "\n" ;
        cout << "LDAP authentication failure\n" << ldap_err2string(rc) << "\n";

        return 1;
    }

    cout << "LDAP bind successful" << "\n";
    return 0;
}

In this time, ldap log had action for finding user.

slapd[35938]: conn=1014 fd=13 ACCEPT from IP=10.161.102.70:45176 (IP=0.0.0.0:636)
slapd[35938]: conn=1014 fd=13 TLS established tls_ssf=256 ssf=256
slapd[35938]: conn=1014 op=0 BIND dn="uid=viewer,ou=users,dc=...,dc=..." method=128
slapd[35938]: conn=1014 op=0 RESULT tag=97 err=49 text=
slapd[35938]: conn=1014 op=1 UNBIND
slapd[35938]: conn=1014 fd=13 closed

What's wrong with a impala-shell??? Why the 'Bind ~~' log has not been print when using impala-shell?

0

There are 0 best solutions below