I'm using CDH Impala and configure a ldap in impala. I try to log in ldap using impala-shell. impala version : 3.2.0v
impala-shell -l --auth_creds_ok_in_clear -u viewer
Login was failed and error log was like this.
I0530 13:18:09.610710 2147 authentication.cc:254] Trying simple LDAP bind for: uid=viewer,ou=users,dc=...,dc=...
W0530 13:18:09.615681 2147 authentication.cc:261] LDAP authentication failure for uid=viewer,ou=users,dc=...,dc=... : Can't contact LDAP server
E0530 13:18:09.615723 2147 authentication.cc:164] SASL message (LDAP): Password verification failed
I0530 13:18:09.615808 2147 thrift-util.cc:123] TAcceptQueueServer: Caught TException: SASL(-13): user not found: Password verification failed
At the same time, the ldap log was like this.
slapd[35938]: conn=1022 fd=13 ACCEPT from IP=10.161.102.70:46408 (IP=0.0.0.0:636)
slapd[35938]: conn=1022 fd=13 TLS established tls_ssf=256 ssf=256
slapd[35938]: conn=1022 fd=13 closed (connection lost)
The weird this was that when i copied the impala's code and tested it, it was successful. Code is this. (https://github.com/apache/impala/blob/branch-3.2.0/be/src/rpc/authentication.cc)
#include <iostream>
#include <string>
#include <ldap.h>
#include <lber.h>
using namespace std;
int main() {
LDAP* ld;
const char *ldapUri = "ldaps://10.161.102.61:636";
int rc = ldap_initialize(&ld, ldapUri);
if (rc != LDAP_SUCCESS) {
cout << "LDAP Initailization failed " << ldap_err2string(rc);
return 1;
}
cout << "PASS : Initailization" << "\n";
int ldap_ver = 3;
ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &ldap_ver);
bool FLAGS_ldap_tls = false;
if (FLAGS_ldap_tls) {
int tls_rc = ldap_start_tls_s(ld, NULL, NULL);
if (tls_rc != LDAP_SUCCESS) {
cout << "Could not start TLS secure connection to LDAP server, " << "Error: " << ldap_err2string(tls_rc);
ldap_unbind_ext(ld, NULL, NULL);
return 1;
}
}
string user = "uid=viewer,ou=users,dc=...,dc=...";
//string user = "";
const char *password = "...";
struct berval pass = {
strlen(password),
(char *) password
};
rc = ldap_sasl_bind_s(
ld,
user.c_str(),
LDAP_SASL_SIMPLE,
&pass,
NULL, NULL, NULL);
ldap_unbind_ext(ld, NULL, NULL);
if (rc != LDAP_SUCCESS) {
cout << "FAILED LDAP contact" << "\n" ;
cout << "LDAP authentication failure\n" << ldap_err2string(rc) << "\n";
return 1;
}
cout << "LDAP bind successful" << "\n";
return 0;
}
In this time, ldap log had action for finding user.
slapd[35938]: conn=1014 fd=13 ACCEPT from IP=10.161.102.70:45176 (IP=0.0.0.0:636)
slapd[35938]: conn=1014 fd=13 TLS established tls_ssf=256 ssf=256
slapd[35938]: conn=1014 op=0 BIND dn="uid=viewer,ou=users,dc=...,dc=..." method=128
slapd[35938]: conn=1014 op=0 RESULT tag=97 err=49 text=
slapd[35938]: conn=1014 op=1 UNBIND
slapd[35938]: conn=1014 fd=13 closed
What's wrong with a impala-shell??? Why the 'Bind ~~' log has not been print when using impala-shell?