We installed Ranger KMS behind a load balancer according to the following documentation:

• https://hdpweb.o.onslip.net/HDPDocuments/HDP3/HDP-3.0.0/installing-ranger-kms/content/install_ranger_kms_using_ambari_kerberized_cluster.html
• https://hdpweb.o.onslip.net/HDPDocuments/HDP3/HDP-3.0.1/configuring-hdfs-encryption/content/enabling_ssl_for_ranger_kms.html
• https://hdpweb.o.onslip.net/HDPDocuments/HDP3/HDP-3.0.1/configuring-hdfs-encryption/content/install_multiple_ranger_kms.html

The integration with Ranger Admin is working fine, but we are not able to authenticate from other clients such as the Hadoop CLI.

Our configurations client side:

• core-site.xml

<property>
  <name>hadoop.security.key.provider.path</name>
  <value>kms://https@xxx:443/kms</value>
</property>
<property>
  <name>hadoop.security.kms.client.authentication.retry-count</name>
  <value>10</value>
</property>
<property>
  <name>hadoop.security.token.service.use_ip</name>
  <value>false</value>
</property>

• kms-site.xml

<property>
  <name>hadoop.kms.authentication.type</name>
  <value>kerberos</value>
</property>

The Hadoop CLI seems not to require the Kerberos ticket for KMS:

org.apache.hadoop.security.authentication.client.AuthenticationException: Authentication failed, URL: https://xxx:443/kms/v1/keys/names?user.name=om, status: 204, message: No Content

The same http request returns the keys when done via curl with negotiation.