We Keep Coding

Authenticating an Impala JDBC Connection in a Kerberized environment

When trying to launch a Java Action within Oozie (CDH6.3.1) I get a GSS initiate failed. The code in question is pretty straight forward:
String impalaUrl = "jdbc:impala://pxyserver.global.ad:21050/default;SSL=1;AuthMech=1;KrbRealm=GLOBAL.AD;KrbHostFQDN=pxyserver.global.ad;KrbServiceName=Impala;sslTrustStore=/opt/cloudera/security/jks/truststore.jks;trustStorePassword=password";
Properties impalaProperties = new Properties();
impalaProperties.put("user", "svcaccount");
impalaProperties.put("password", "svcpassword");
impalaProperties.put("Driver", "com.cloudera.impala.jdbc41.Driver");
try {
setConnection(DriverManager.getConnection(impalaUrl , impalaProperties));
} catch (SQLException e) {
e.printStackTrace();
}
Running this gives the following stack trace:
java.sql.SQLException: [Cloudera][ImpalaJDBCDriver](500164) Error initialized or created transport for authentication: [Cloudera][ImpalaJDBCDriver](500169) Unable to connect to server: GSS initiate failed.
at com.cloudera.impala.hivecommon.api.HiveServer2ClientFactory.createTransport(Unknown Source)
at com.cloudera.impala.hivecommon.api.ServiceDiscoveryFactory.createClient(Unknown Source)
at com.cloudera.impala.hivecommon.core.HiveJDBCCommonConnection.establishConnection(Unknown Source)
at com.cloudera.impala.impala.core.ImpalaJDBCDSIConnection.establishConnection(Unknown Source)
at com.cloudera.impala.jdbc.core.LoginTimeoutConnection.connect(Unknown Source)
at com.cloudera.impala.jdbc.common.BaseConnectionFactory.doConnect(Unknown Source)
at com.cloudera.impala.jdbc.common.AbstractDriver.connect(Unknown Source)
at java.sql.DriverManager.getConnection(DriverManager.java:664)
at java.sql.DriverManager.getConnection(DriverManager.java:208)
I can fix this by kiniting with a keytab. However in our production environment Oozie runs this on one of many worker nodes and they do not have valid kerberos tickets. What are my options here? If possible I'd rather not kinit every day on each of our 40 worker nodes, is there a parameter I am missing here?
Thanks

Use JGit to access existing clone?

I have a clone of a repository on my computer already. I wish to create a Java program that pulls when it opens and pushes when it closes.
This is how I initiate JGit:
auth = new UsernamePasswordCredentialsProvider("[username]", "[pass]");
git = Git.open(new File(path_to_git + "\\.git"));
git.checkout().setName("master").call();
git.pull().setCredentialsProvider(auth).call();
This works the first time I start up, but if I close and reopen the program I get the error
Exception in thread "JavaFX Application Thread" Exception in thread "main" java.lang.ExceptionInInitializerError
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Unknown Source)
at com.sun.javafx.application.LauncherImpl.lambda$launchApplicationWithArgs$2(LauncherImpl.java:352)
at com.sun.javafx.application.PlatformImpl.lambda$runAndWait$7(PlatformImpl.java:326)
at com.sun.javafx.application.PlatformImpl.lambda$null$5(PlatformImpl.java:295)
at java.security.AccessController.doPrivileged(Native Method)
at com.sun.javafx.application.PlatformImpl.lambda$runLater$6(PlatformImpl.java:294)
at com.sun.glass.ui.InvokeLaterDispatcher$Future.run(InvokeLaterDispatcher.java:95)
at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
at com.sun.glass.ui.win.WinApplication.lambda$null$4(WinApplication.java:186)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.UnsupportedOperationException: Cannot check out from unborn branch
at org.eclipse.jgit.api.CheckoutCommand.call(CheckoutCommand.java:235)
at com.company.app.Main.<clinit>(Main.java:59)
... 11 more
When the program closes I call the function pushToGit() which is defined as:
public static void pushToGit() {
try {
git.remoteAdd()
.setName("origin")
.setUri(new URIish("https://github.com/[username]/[repo]"))
.call();
git.commit().setMessage("from database application").setAuthor(new PersonIdent("[name]","[email]")).call();
git.push().setCredentialsProvider(auth).call();
} catch (GitAPIException | URISyntaxException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
Whenever I run the program, I need to delete the local repo and reclone it.

You can try with the following example code snippet.
Git git = Git.cloneRepository()
.setURI( "https://github.com/someRepoName" )
.setDirectory( "/path/to/repo" )
.setBranch( "refs/heads/master" )
.call();
You can refer below the link for more details.
https://www.codeaffine.com/2015/11/30/jgit-clone-repository/
In the higher version of Jgit api, you can use CloneCommand, you can check below the link.
https://www.programcreek.com/java-api-examples/?api=org.eclipse.jgit.api.CloneCommand

javax.net.ssl.SSLException: Invalid Padding length

I am getting this exception when trying to execute a webservice over https. This exception occures the movement I try to get the service instance.
I followed the below steps for generating the webservice client using wsImport.exe tool.
I manualy downloaded the wsdl from the site
Used wsImport tool to generate the client java files
Added the java files to my project in eclipse
Wrote a test client as below to test the service instance
public static void main(String[] args) {
String certificatesTrustStorePath = "c:/Apps/Java/jdk1.8.0_25/jre/lib/security/cacerts";
// if I don't set the store path, I get below error
//javax.net.ssl.SSLHandshakeException:
//sun.security.validator.ValidatorException: PKIX path building failed:
//sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
System.setProperty("javax.net.ssl.trustStore", certificatesTrustStorePath);
URL wsdlLocation = null;
String https_url ="https://localhost/services/WebService/wsdl/WebService.wsdl";
try {
wsdlLocation = new URL(https_url);
} catch (MalformedURLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
//This is the line where I get the below execption
WebServiceService webServiceService = new WebServiceService(wsdlLocation,
new QName("http://webservice.com", "WebServiceService"));
}
With the above code I below execption
Exception in thread "main" com.sun.xml.internal.ws.wsdl.parser.InaccessibleWSDLException: 2 counts of InaccessibleWSDLException.
javax.net.ssl.SSLException: Invalid Padding length: 76
javax.net.ssl.SSLException: Invalid Padding length: 50
at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.tryWithMex(Unknown Source)
at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(Unknown Source)
at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(Unknown Source)
at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(Unknown Source)
at com.sun.xml.internal.ws.client.WSServiceDelegate.parseWSDL(Unknown Source)
at com.sun.xml.internal.ws.client.WSServiceDelegate.<init>(Unknown Source)
at com.sun.xml.internal.ws.client.WSServiceDelegate.<init>(Unknown Source)
at com.sun.xml.internal.ws.client.WSServiceDelegate.<init>(Unknown Source)
at com.sun.xml.internal.ws.client.WSServiceDelegate.<init>(Unknown Source)
at com.sun.xml.internal.ws.spi.ProviderImpl.createServiceDelegate(Unknown Source)
at javax.xml.ws.Service.<init>(Unknown Source)
at com.webservice.WebServiceService.<init>(WebServiceService.java:42)
at com.client.Client.main(Client.java:46)
Everytime I execute, the numbers in the front ot "Invalid Pad length" is different. this time it is 76 and 50. other time it was 67, 106. etc
Please help,
I am using latest version of Java i.e. 1.8.0_51.

It seems similar to this problem: https://community.oracle.com/thread/2506695
Have you tried using bouncycastle?

Java 8 has this issue... tested with Java 7. Same code is working fine.

Rmi server port alrady used

I want to run simple rmi server code below.
Firstly, I write command "rmiregistry 9260" and so I started the rmi register.
Then I run following code but I get errors.
What can cause these errors? Note that I tried different port numbers.
public class Server {
public static void main(String args[]) {
try {
PaymentImpl robj = new PaymentImpl();
Payment stub = (Payment) UnicastRemoteObject.exportObject(robj, 9260);
Registry registry = LocateRegistry.getRegistry();
registry.bind("Mortgage", stub);
System.out.println("Mortgage Server is ready to listen... ");
} catch (Exception e) {
System.err.println("Server exception thrown: " + e.toString());
e.printStackTrace();
}
}
}
Server exception thrown: java.rmi.server.ExportException: Port already in use
260; nested exception is:
java.net.BindException: Address already in use
java.rmi.server.ExportException: Port already in use: 9260; nested exception
java.net.BindException: Address already in use
at sun.rmi.transport.tcp.TCPTransport.listen(Unknown Source)
at sun.rmi.transport.tcp.TCPTransport.exportObject(Unknown Source)
at sun.rmi.transport.tcp.TCPEndpoint.exportObject(Unknown Source)
at sun.rmi.transport.LiveRef.exportObject(Unknown Source)
at sun.rmi.server.UnicastServerRef.exportObject(Unknown Source)
at java.rmi.server.UnicastRemoteObject.exportObject(Unknown Source)
at java.rmi.server.UnicastRemoteObject.exportObject(Unknown Source)
at Server.main(Server.java:14)
Caused by: java.net.BindException: Address already in use
at java.net.PlainSocketImpl.socketBind(Native Method)
at java.net.AbstractPlainSocketImpl.bind(Unknown Source)
at java.net.ServerSocket.bind(Unknown Source)
at java.net.ServerSocket.<init>(Unknown Source)
at java.net.ServerSocket.<init>(Unknown Source)
at sun.rmi.transport.proxy.RMIDirectSocketFactory.createServerSocket(
nown Source)
at sun.rmi.transport.proxy.RMIMasterSocketFactory.createServerSocket(
nown Source)
at sun.rmi.transport.tcp.TCPEndpoint.newServerSocket(Unknown Source)
... 8 more

If you're using 9260 for a separate Registry process you can't use it again in this process. You can use 9260 for both by starting the Registry in this process, with LocateRegistry.createRegistry(). Store the return value into a static variable to prevent GC.

Applet signed throw: java.security.AccessControlException. How can I make it run?

After hours of work (I'm not a java programmer) I've managed to pack and put inside an applet wich make an ftp-upload to a remote server. The main file is "prova.class" inside "invia.jar"; I use a third-part library, placed in "edtftpj.jar". I have signed both file and included them in the page with the following code:
Index.html
<applet width="300" height="300" classpath="./" code="prova.class" archive="invio.jar,edtftpj.jar"> </applet>
now, when I point the browser to my page I found this message on the consolle:
Could not read property 'edtftp.log.level' due to security permissions
Could not read property 'edtftp.log.log4j' due to security permissions
Could not read property 'edtftp.log.log4j' due to security permissions
java.security.AccessControlException: access denied (java.net.SocketPermission www.artkiller-web.com resolve)
at java.security.AccessControlContext.checkPermission(Unknown Source)
at java.security.AccessController.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkPermission(Unknown Source)
at java.lang.SecurityManager.checkConnect(Unknown Source)
at sun.plugin2.applet.Applet2SecurityManager.checkConnect(Unknown Source)
at java.net.InetAddress.getAllByName0(Unknown Source)
at java.net.InetAddress.getAllByName(Unknown Source)
at java.net.InetAddress.getAllByName(Unknown Source)
at java.net.InetAddress.getByName(Unknown Source)
at com.enterprisedt.net.ftp.FTPClient.connect(FTPClient.java:966)
at com.enterprisedt.net.ftp.FileTransferClient.connect(FileTransferClient.java:386)
at prova.start(prova.java:44)
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Any Idea of how to work-it around?
thank u in advance
ArtoAle

You need to wrap the connection url in a privileged block of code.
Also looks like you are having issues reading from the properties file, The properties file you can package right in your jar, if your trying to read the properties file from the client machine you will need to wrap that code in a privileged block of code as well.
Here is a block of code I used in a another answer for getting a URL through the access controller.
try
{
final String imageURL = "http://www.google.com/intl/en_ALL/images/logo.gif";
URL url = (URL) AccessController.doPrivileged(new PrivilegedAction()
{
public Object run()
{
try
{
return new URL(imageURL);
}
catch (MalformedURLException e)
{
e.printStackTrace();
return null;
}
}
});
if(url == null)
{
// Something is wrong notify the user
}
else
{
// We know the url is good so continue on
img = ImageIO.read(url);
}
}
catch (IOException e)
{
System.out.println(e);
}