Unable to obtain keystore from file /etc/hadoop/conf/ranger-plugin-keystore.jks

[JavadHosseini]

I enabled Trino Ranger plugin on Trino 436 in docker environment. Also, I changed "policycache" file from /etc/ranger/trino path to /usr/lib/trino/etc/ranger for be able to write on that. policycache would be created and written but after starting container this error shows up:

2024-07-19T16:19:27.858Z INFO PolicyRefresher(serviceName=trino)-203 stdout ERROR - Unable to obtain keystore from file [/etc/hadoop/conf/ranger-plugin-keystore.jks] 2024-07-19T16:19:27.859Z INFO PolicyRefresher(serviceName=trino)-203 stdout ERROR - gdsInfo retriever encountered exception. Returning null gdsInfojava.lang.IllegalStateException: Unable to find keystore file :/etc/hadoop/conf/ranger-plugin-keystore.jks at org.apache.ranger.plugin.util.RangerRESTClient.getKeyManagers(RangerRESTClient.java:318) at org.apache.ranger.plugin.util.RangerRESTClient.getKeyManagers(RangerRESTClient.java:293) at org.apache.ranger.plugin.util.RangerRESTClient.buildClient(RangerRESTClient.java:205) at org.apache.ranger.plugin.util.RangerRESTClient.getClient(RangerRESTClient.java:193) at org.apache.ranger.plugin.util.RangerRESTClient.get(RangerRESTClient.java:473) at org.apache.ranger.admin.client.RangerAdminRESTClient.getGdsInfoIfUpdated(RangerAdminRESTClient.java:867) at org.apache.ranger.plugin.contextenricher.RangerAdminGdsInfoRetriever.retrieveGdsInfo(RangerAdminGdsInfoRetriever.java:73) at org.apache.ranger.plugin.contextenricher.RangerGdsEnricher$RangerGdsInfoRefresher.populateGdsInfo(RangerGdsEnricher.java:288) at org.apache.ranger.plugin.contextenricher.RangerGdsEnricher$RangerGdsInfoRefresher.access$000(RangerGdsEnricher.java:180) at org.apache.ranger.plugin.contextenricher.RangerGdsEnricher.init(RangerGdsEnricher.java:95) at org.apache.ranger.plugin.policyengine.RangerPolicyRepository.buildContextEnricher(RangerPolicyRepository.java:1087) at org.apache.ranger.plugin.policyengine.RangerPolicyRepository.buildContextEnrichers(RangerPolicyRepository.java:1034) at org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:238) at org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:186) at org.apache.ranger.plugin.policyengine.PolicyEngine.<init>(PolicyEngine.java:227) at org.apache.ranger.plugin.policyengine.RangerPolicyEngineImpl.<init>(RangerPolicyEngineImpl.java:100) at org.apache.ranger.plugin.service.RangerBasePlugin.setPolicies(RangerBasePlugin.java:399) at org.apache.ranger.plugin.util.PolicyRefresher.loadPolicy(PolicyRefresher.java:268) at org.apache.ranger.plugin.util.PolicyRefresher.run(PolicyRefresher.java:214)

however in install.properties it is mentioned that we do not need to use SSL.

[aakashnand]

Not sure how I can help with this information but confirm if you SSL is enabled on your ranger admin

[JavadHosseini]

Not sure how I can help with this information but confirm if you SSL is enabled on your ranger admin

Oh yes, SSL is enabled on ranger admin. So I should create keystore file, right?

[aakashnand]

yes, I haven't tried to setup SSL by myself but please see if you can find it in ranger documentation

[JavadHosseini]

I added keystore and truststore files and the issue has been resolved. Although Trino ranger plugin fetched the roles in policycache dir, still users defined in ranger can't authenticate. What should I set authentication type field in trino? I tried "password" type but still no luck.

[aakashnand]

Your next question is out of scope of this repository and discussion.

You can find more information about trino authentication types on official documentation page. https://trino.io/docs/current/security/authentication-types.html

When I used trino, all of my users were stored in AzureAD and I connected AzureAD->Ranger->Trino together. I used multiple authenticators such as JWT, Oauth and password.

Simply setting authentication method to password will not work. You may need to add more settings before you can use it with Ranger