Manish M Pillai created AMBARI-26620:
----------------------------------------
Summary: LDAPS setup, sync, and login fail on Ambari 3.0.0 due to
Python 3 encoding bugs and a Java 9+ module restriction
Key: AMBARI-26620
URL: https://issues.apache.org/jira/browse/AMBARI-26620
Project: Ambari
Issue Type: Bug
Components: ambari-sever
Affects Versions: 3.0.0
Reporter: Manish M Pillai
Assignee: Manish M Pillai
Setting up LDAPS end-to-end on Ambari 3.0.0 (Python 3, Java 9+) fails at three
separate points in the flow — {{{}setup-ldap{}}}, {{{}sync-ldap{}}}, and LDAP
login. All three block LDAP from working at all on a fresh 3.0.0 install
running modern Python/Java, so they're reported together as they form one
continuous blocker for the same feature (LDAP integration).
h3. Bug 1 — {{setup-ldap}} fails while saving configuration
*Where:* {{{}ambari_server/serverUtils.py{}}}, function
{{perform_changes_via_rest_api()}}
*Cause:* The function builds the PUT/POST request body using
{{{}json.dumps(){}}}, which returns a Python {{{}str{}}}. Python 3's
{{urllib.request.urlopen()}} requires the request body to be {{{}bytes{}}}, so
it raises a {{{}TypeError{}}}. Same root cause class as AMBARI-26062, but that
fix only covered {{configs.py}} — this function was missed.
*Repro:* Run {{{}ambari-server setup-ldap -v{}}}, complete all prompts, confirm
save.
*Exact error:*
{code:java}
Saving LDAP properties...
Traceback (most recent call last):
File "/usr/sbin/ambari-server.py", line 1998, in <module>
mainBody()
File "/usr/sbin/ambari-server.py", line 1960, in mainBody
main(options, args, parser)
File "/usr/sbin/ambari-server.py", line 1902, in main
action_obj.execute()
File "/usr/sbin/ambari-server.py", line 131, in execute
self.fn(*self.args, **self.kwargs)
File "/usr/lib/ambari-server/lib/ambari_server/setupSecurity.py", line 1647,
in setup_ldap
admin_login, admin_password, properties, ldap_property_value_map
File "/usr/lib/ambari-server/lib/ambari_server/setupSecurity.py", line 1315,
in update_ldap_configuration
properties, admin_login, admin_password, SETUP_LDAP_CONFIG_URL, "PUT",
request_data
File "/usr/lib/ambari-server/lib/ambari_server/serverUtils.py", line 269, in
perform_changes_via_rest_api
urllib.request.urlopen(request, context=get_ssl_context(properties))
File "/usr/lib64/python3.6/urllib/request.py", line 223, in urlopen
return opener.open(url, data, timeout)
File "/usr/lib64/python3.6/urllib/request.py", line 524, in open
req = meth(req)
File "/usr/lib64/python3.6/urllib/request.py", line 1279, in do_request_
raise TypeError(msg)
TypeError: POST data should be bytes, an iterable of bytes, or a file object.
It cannot be of type str. {code}
h3. Bug 2 — {{sync-ldap}} fails during sync event creation
*Where:* {{{}ambari_server/setupSecurity.py{}}}, function {{sync_ldap()}}
*Cause:* Same encoding gap as Bug 1, in a different function that builds two
separate REST request bodies for LDAP sync, neither encoded to bytes before
being passed to {{{}urlopen(){}}}. Confirmed still present in current Ambari
trunk as of July 2026 — not fixed upstream.
*Repro:* With {{setup-ldap}} working, run {{{}ambari-server sync-ldap --all{}}}.
*Exact error:*
{code:java}
Fetching LDAP configuration from DB.
Syncing all.ERROR: Exiting with exit code 1.
REASON: Sync event creation failed. Error details: POST data should be bytes,
an iterable of bytes, or a file object. It cannot be of type str. {code}
h3. Bug 3 — LDAP login fails with Java module access error
*Where:* JVM startup args, {{ambari-env.sh}} ({{{}AMBARI_JVM_ARGS{}}})
*Cause:* Spring LDAP's {{AbstractContextSource}} reflectively accesses the
JDK-internal class {{{}com.sun.jndi.ldap.LdapCtxFactory{}}}. Java 9+'s module
system blocks this by default since {{java.naming}} does not export that
package to unnamed modules. Ambari's default JVM args already include several
{{--add-opens}} flags for {{java.base}} packages but are missing one for
{{{}java.naming{}}}.
*Repro:* With Bugs 1 and 2 fixed, log in to the Ambari UI as a synced LDAP
user, on Java 9+.
*Exact error:*
{code:java}
Caused by: java.lang.ExceptionInInitializerError: Exception
java.lang.IllegalAccessError: class
org.springframework.ldap.core.support.AbstractContextSource (in unnamed module
@0x6a472554) cannot access class com.sun.jndi.ldap.LdapCtxFactory (in module
java.naming) because module java.naming does not export com.sun.jndi.ldap to
unnamed module @0x6a472554 [in thread "ambari-client-thread-29"]
at
org.springframework.ldap.core.support.AbstractContextSource.<clinit>(AbstractContextSource.java:77)
at
org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.loadLdapAuthenticationProvider(AmbariLdapAuthenticationProvider.java:166)
at
org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.authenticate(AmbariLdapAuthenticationProvider.java:91)
...
java.lang.NoClassDefFoundError: Could not initialize class
org.springframework.ldap.core.support.LdapContextSource
at
org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.loadLdapAuthenticationProvider(AmbariLdapAuthenticationProvider.java:166)
... {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
