[
https://issues.apache.org/jira/browse/AMBARI-26620?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18098443#comment-18098443
]
Manish M Pillai commented on AMBARI-26620:
------------------------------------------
PR : https://github.com/apache/ambari/pull/4151
> LDAPS setup, sync, and login fail on Ambari 3.0.0 due to Python 3 encoding
> bugs and a Java 9+ module restriction
> ----------------------------------------------------------------------------------------------------------------
>
> Key: AMBARI-26620
> URL: https://issues.apache.org/jira/browse/AMBARI-26620
> Project: Ambari
> Issue Type: Bug
> Components: ambari-sever
> Affects Versions: 3.0.0
> Reporter: Manish M Pillai
> Assignee: Manish M Pillai
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Setting up LDAPS end-to-end on Ambari 3.0.0 (Python 3, Java 9+) fails at
> three separate points in the flow — {{{}setup-ldap{}}}, {{{}sync-ldap{}}},
> and LDAP login. All three block LDAP from working at all on a fresh 3.0.0
> install running modern Python/Java, so they're reported together as they form
> one continuous blocker for the same feature (LDAP integration).
> h3. Bug 1 — {{setup-ldap}} fails while saving configuration
> *Where:* {{{}ambari_server/serverUtils.py{}}}, function
> {{perform_changes_via_rest_api()}}
> *Cause:* The function builds the PUT/POST request body using
> {{{}json.dumps(){}}}, which returns a Python {{{}str{}}}. Python 3's
> {{urllib.request.urlopen()}} requires the request body to be {{{}bytes{}}},
> so it raises a {{{}TypeError{}}}. Same root cause class as AMBARI-26062, but
> that fix only covered {{configs.py}} — this function was missed.
> *Repro:* Run {{{}ambari-server setup-ldap -v{}}}, complete all prompts,
> confirm save.
> *Exact error:*
> {code:java}
> Saving LDAP properties...
> Traceback (most recent call last):
> File "/usr/sbin/ambari-server.py", line 1998, in <module>
> mainBody()
> File "/usr/sbin/ambari-server.py", line 1960, in mainBody
> main(options, args, parser)
> File "/usr/sbin/ambari-server.py", line 1902, in main
> action_obj.execute()
> File "/usr/sbin/ambari-server.py", line 131, in execute
> self.fn(*self.args, **self.kwargs)
> File "/usr/lib/ambari-server/lib/ambari_server/setupSecurity.py", line
> 1647, in setup_ldap
> admin_login, admin_password, properties, ldap_property_value_map
> File "/usr/lib/ambari-server/lib/ambari_server/setupSecurity.py", line
> 1315, in update_ldap_configuration
> properties, admin_login, admin_password, SETUP_LDAP_CONFIG_URL, "PUT",
> request_data
> File "/usr/lib/ambari-server/lib/ambari_server/serverUtils.py", line 269,
> in perform_changes_via_rest_api
> urllib.request.urlopen(request, context=get_ssl_context(properties))
> File "/usr/lib64/python3.6/urllib/request.py", line 223, in urlopen
> return opener.open(url, data, timeout)
> File "/usr/lib64/python3.6/urllib/request.py", line 524, in open
> req = meth(req)
> File "/usr/lib64/python3.6/urllib/request.py", line 1279, in do_request_
> raise TypeError(msg)
> TypeError: POST data should be bytes, an iterable of bytes, or a file object.
> It cannot be of type str. {code}
> h3. Bug 2 — {{sync-ldap}} fails during sync event creation
> *Where:* {{{}ambari_server/setupSecurity.py{}}}, function {{sync_ldap()}}
> *Cause:* Same encoding gap as Bug 1, in a different function that builds two
> separate REST request bodies for LDAP sync, neither encoded to bytes before
> being passed to {{{}urlopen(){}}}. Confirmed still present in current Ambari
> trunk as of July 2026 — not fixed upstream.
> *Repro:* With {{setup-ldap}} working, run {{{}ambari-server sync-ldap
> --all{}}}.
> *Exact error:*
> {code:java}
> Fetching LDAP configuration from DB.
> Syncing all.ERROR: Exiting with exit code 1.
> REASON: Sync event creation failed. Error details: POST data should be bytes,
> an iterable of bytes, or a file object. It cannot be of type str. {code}
> h3. Bug 3 — LDAP login fails with Java module access error
> *Where:* JVM startup args, {{ambari-env.sh}} ({{{}AMBARI_JVM_ARGS{}}})
> *Cause:* Spring LDAP's {{AbstractContextSource}} reflectively accesses the
> JDK-internal class {{{}com.sun.jndi.ldap.LdapCtxFactory{}}}. Java 9+'s module
> system blocks this by default since {{java.naming}} does not export that
> package to unnamed modules. Ambari's default JVM args already include several
> {{--add-opens}} flags for {{java.base}} packages but are missing one for
> {{{}java.naming{}}}.
> *Repro:* With Bugs 1 and 2 fixed, log in to the Ambari UI as a synced LDAP
> user, on Java 9+.
> *Exact error:*
> {code:java}
> Caused by: java.lang.ExceptionInInitializerError: Exception
> java.lang.IllegalAccessError: class
> org.springframework.ldap.core.support.AbstractContextSource (in unnamed
> module @0x6a472554) cannot access class com.sun.jndi.ldap.LdapCtxFactory (in
> module java.naming) because module java.naming does not export
> com.sun.jndi.ldap to unnamed module @0x6a472554 [in thread
> "ambari-client-thread-29"]
> at
> org.springframework.ldap.core.support.AbstractContextSource.<clinit>(AbstractContextSource.java:77)
> at
> org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.loadLdapAuthenticationProvider(AmbariLdapAuthenticationProvider.java:166)
> at
> org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.authenticate(AmbariLdapAuthenticationProvider.java:91)
> ...
> java.lang.NoClassDefFoundError: Could not initialize class
> org.springframework.ldap.core.support.LdapContextSource
> at
> org.apache.ambari.server.security.authorization.AmbariLdapAuthenticationProvider.loadLdapAuthenticationProvider(AmbariLdapAuthenticationProvider.java:166)
> ... {code}
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
