TT Bigdata
JaneTTR
2026-01-23
目录

[22209]Ranger Kafka Lookup 缺少 JAAS 配置

# Ranger Admin Lookup Kafka 资源失败：JAAS configuration missing

# 一、问题现象 Ranger Kafka Lookup

在 Ranger Admin Web UI 中配置 Kafka Service 后，进入策略页面进行资源选择（例如 consumer group 下拉框），页面直接报错，资源无法加载。 同时在 Ranger Admin 主机上可以观察到日志异常，且日志文件大小保持为 0，说明并未进入正常的 SQL 或 DB 处理阶段。

image-20260124183744118

-rw-r--r-- 1 ranger hadoop     0 Jan 24 18:37 ranger_admin_sql.log
-rw-r--r-- 1 ranger hadoop     0 Jan 24 18:37 ranger_db_patch.log
1
2

进一步查看 ranger-admin-dev2-ranger.log，可以看到在执行 Kafka 资源查询（lookupResource）时直接失败：

-rw-r--r-- 1 ranger hadoop     0 Jan 24 18:37 ranger_admin_sql.log
-rw-r--r-- 1 ranger hadoop     0 Jan 24 18:37 ranger_db_patch.log
[root@dev2 admin]# tail -f ranger-admin-dev2-ranger.log
2026-01-24 10:38:35,912 [timed-executor-pool-0] ERROR [ServiceMgr.java:605] TimedCallable.call: Error:java.lang.Exception: JAAS configuration missing or not correct in Ranger Kafka Service...bootstrap.servers,security.protocol,sasl.mechanism,kafka.keytab,kafka.principal
2026-01-24 10:38:35,913 [http-nio-6080-exec-4] ERROR [ServiceREST.java:1196] lookupResource(abc_kafka, ResourceLookupContext={resourceName=consumergroup,userInput=,resources={consumergroup=[*]}}) failed
org.apache.ranger.plugin.client.HadoopException: java.lang.Exception: JAAS configuration missing or not correct in Ranger Kafka Service...bootstrap.servers,security.protocol,sasl.mechanism,kafka.keytab,kafka.principal
        at org.apache.ranger.common.TimedExecutor.generateHadoopException(TimedExecutor.java:126)
        at org.apache.ranger.common.TimedExecutor.timedTask(TimedExecutor.java:96)
        at org.apache.ranger.biz.ServiceMgr.lookupResource(ServiceMgr.java:139)
        at org.apache.ranger.rest.ServiceREST.lookupResource(ServiceREST.java:1192)
        at org.apache.ranger.rest.ServiceREST$$FastClassBySpringCGLIB$$92dab672.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:793)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:763)
        at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:61)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:763)
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:123)
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:388)
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:119)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
        at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:763)
        at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:708)
        at org.apache.ranger.rest.ServiceREST$$EnhancerBySpringCGLIB$$33c25570.lookupResource(<generated>)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60)
        at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$TypeOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:185)
        at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75)
        at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:302)
        at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147)
        at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108)
        at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147)
        at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84)
        at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542)
        at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473)
        at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419)
        at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409)
        at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409)
        at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558)
        at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:582)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:212)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:156)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:181)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:156)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:337)
        at org.apache.ranger.security.web.filter.RangerSecurityContextFormationFilter.doFilter(RangerSecurityContextFormationFilter.java:142)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:115)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:81)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:122)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:116)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126)
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:81)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:109)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.apache.ranger.security.web.filter.RangerCSRFPreventionFilter$ServletFilterHttpInteraction.proceed(RangerCSRFPreventionFilter.java:237)
        at org.apache.ranger.security.web.filter.RangerCSRFPreventionFilter.handleHttpInteraction(RangerCSRFPreventionFilter.java:179)
        at org.apache.ranger.security.web.filter.RangerCSRFPreventionFilter.doFilter(RangerCSRFPreventionFilter.java:192)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.apache.ranger.security.web.filter.RangerKRBAuthenticationFilter.doFilter(RangerKRBAuthenticationFilter.java:384)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.apache.ranger.security.web.filter.RangerSSOAuthenticationFilter.doFilter(RangerSSOAuthenticationFilter.java:283)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:166)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:223)
        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:217)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103)
        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)
        at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:112)
        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:82)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.session.ForceEagerSessionCreationFilter.doFilterInternal(ForceEagerSessionCreationFilter.java:45)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:346)
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:221)
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:186)
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354)
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:181)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:156)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:494)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:682)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:367)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:639)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:932)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1695)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:748)
Caused by: java.util.concurrent.ExecutionException: java.lang.Exception: JAAS configuration missing or not correct in Ranger Kafka Service...bootstrap.servers,security.protocol,sasl.mechanism,kafka.keytab,kafka.principal
        at java.util.concurrent.FutureTask.report(FutureTask.java:122)
        at java.util.concurrent.FutureTask.get(FutureTask.java:206)
        at org.apache.ranger.common.TimedExecutor.timedTask(TimedExecutor.java:90)
        ... 116 common frames omitted
Caused by: java.lang.Exception: JAAS configuration missing or not correct in Ranger Kafka Service...bootstrap.servers,security.protocol,sasl.mechanism,kafka.keytab,kafka.principal
        at org.apache.ranger.services.kafka.client.ServiceKafkaConnectionMgr.getKafkaClient(ServiceKafkaConnectionMgr.java:37)
        at org.apache.ranger.services.kafka.RangerServiceKafka.lookupResource(RangerServiceKafka.java:88)
        at org.apache.ranger.biz.ServiceMgr$LookupCallable.actualCall(ServiceMgr.java:637)
        at org.apache.ranger.biz.ServiceMgr$LookupCallable.actualCall(ServiceMgr.java:621)
        at org.apache.ranger.biz.ServiceMgr$TimedCallable.call(ServiceMgr.java:603)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        ... 1 common frames omitted
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

现象要点

  • 报错发生在 Ranger Admin Lookup 阶段，而非 Kafka Broker 或插件侧。
  • 页面上的 Kafka 资源下拉框（Topic / Consumer Group）无法展开，UI 操作立即失败。
  • 日志明确提示：JAAS configuration missing or not correct，并点名缺失的关键参数。

# 二、异常调用链路解析 Lookup 执行路径

从堆栈可以看到，请求并不是走插件下发路径，而是 Ranger Admin 自身在执行一次 Kafka 客户端连接：

ServiceREST.lookupResource
  -> ServiceMgr.lookupResource
    -> ServiceMgr$LookupCallable
      -> RangerServiceKafka.lookupResource
        -> ServiceKafkaConnectionMgr.getKafkaClient
1
2
3
4
5

在这一过程中，ServiceKafkaConnectionMgr 会根据 Kafka Service 的配置项 构造一个 Kafka 客户端，用于实时拉取资源列表（例如 consumer group）。 一旦 Kafka Service 中缺少 Kerberos/SASL 相关参数，该客户端在初始化阶段就会直接失败，从而抛出上述异常。

关键理解

Ranger Admin 在做 Kafka Resource Lookup 时，本身就是一个 Kafka 客户端。 它不会复用 Broker 上的 JAAS，也不会自动继承插件配置，而是完全依赖 Kafka Service 中填写的连接与安全参数。

# 三、错误原因聚焦：Kafka Service 缺少 JAAS 关键参数 配置缺失

异常信息中已经明确指出了缺失项：

bootstrap.servers
security.protocol
sasl.mechanism
kafka.keytab
kafka.principal
1
2
3
4
5

这意味着当前 Kafka Service 的配置，仅满足“策略下发”的基本需求，但并不满足 Ranger Admin 主动访问 Kafka 的条件。

处理办法可参考

22209:解决办法

# 五、修改后验证结果 验证通过

配置补齐后，重新观察 Ranger Admin 日志：

image-20260124200755510

可以看到：

  • JAAS configuration missing 相关错误不再出现
  • Lookup 请求能够正常返回，不再抛异常

在 Web 页面侧，无论反复点击 consumer group / topic 等资源选择项，均不再报错：

image-20260124200932370

最终状态

  • Ranger Admin Kafka Service Lookup 正常
  • Kafka 资源可以在策略页面中稳定加载
  • 后续策略配置与下发流程不再被 Lookup 阶段阻断
#Ranger Admin#Kafka Service#Resource Lookup#JAAS#GSSAPI#kafka.principal#kafka.keytab#ServiceKafkaConnectionMgr#BIGTOP 3.2.0
[22210]解决办法
[22209]解决办法

← [22209]解决办法→

最近更新
01
Ambari-Web-3.0.0本地启动与二开环境搭建
01-28
02
左侧 Service 数量控制原理与实现
01-28
03
[22212]Ambari 3.0.0 左侧服务菜单滚动条缺失修复
01-28
更多文章>
Theme by Vdoing | Copyright © 2017-2026 JaneTTR | MIT License