{"action":"created","issue":{"url":"https://api.github.com/repos/prestodb/presto/issues/8569","repository_url":"https://api.github.com/repos/prestodb/presto","labels_url":"https://api.github.com/repos/prestodb/presto/issues/8569/labels{/name}","comments_url":"https://api.github.com/repos/prestodb/presto/issues/8569/comments","events_url":"https://api.github.com/repos/prestodb/presto/issues/8569/events","html_url":"https://github.com/prestodb/presto/issues/8569","id":244850826,"node_id":"MDU6SXNzdWUyNDQ4NTA4MjY=","number":8569,"title":"LDAP authentication","user":{"login":"moshir","id":645762,"node_id":"MDQ6VXNlcjY0NTc2Mg==","avatar_url":"https://avatars3.githubusercontent.com/u/645762?v=4","gravatar_id":"","url":"https://api.github.com/users/moshir","html_url":"https://github.com/moshir","followers_url":"https://api.github.com/users/moshir/followers","following_url":"https://api.github.com/users/moshir/following{/other_user}","gists_url":"https://api.github.com/users/moshir/gists{/gist_id}","starred_url":"https://api.github.com/users/moshir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moshir/subscriptions","organizations_url":"https://api.github.com/users/moshir/orgs","repos_url":"https://api.github.com/users/moshir/repos","events_url":"https://api.github.com/users/moshir/events{/privacy}","received_events_url":"https://api.github.com/users/moshir/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"findepi","id":144328,"node_id":"MDQ6VXNlcjE0NDMyOA==","avatar_url":"https://avatars0.githubusercontent.com/u/144328?v=4","gravatar_id":"","url":"https://api.github.com/users/findepi","html_url":"https://github.com/findepi","followers_url":"https://api.github.com/users/findepi/followers","following_url":"https://api.github.com/users/findepi/following{/other_user}","gists_url":"https://api.github.com/users/findepi/gists{/gist_id}","starred_url":"https://api.github.com/users/findepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/findepi/subscriptions","organizations_url":"https://api.github.com/users/findepi/orgs","repos_url":"https://api.github.com/users/findepi/repos","events_url":"https://api.github.com/users/findepi/events{/privacy}","received_events_url":"https://api.github.com/users/findepi/received_events","type":"User","site_admin":false},"assignees":[{"login":"findepi","id":144328,"node_id":"MDQ6VXNlcjE0NDMyOA==","avatar_url":"https://avatars0.githubusercontent.com/u/144328?v=4","gravatar_id":"","url":"https://api.github.com/users/findepi","html_url":"https://github.com/findepi","followers_url":"https://api.github.com/users/findepi/followers","following_url":"https://api.github.com/users/findepi/following{/other_user}","gists_url":"https://api.github.com/users/findepi/gists{/gist_id}","starred_url":"https://api.github.com/users/findepi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/findepi/subscriptions","organizations_url":"https://api.github.com/users/findepi/orgs","repos_url":"https://api.github.com/users/findepi/repos","events_url":"https://api.github.com/users/findepi/events{/privacy}","received_events_url":"https://api.github.com/users/findepi/received_events","type":"User","site_admin":false}],"milestone":null,"comments":9,"created_at":"2017-07-22T14:38:02Z","updated_at":"2018-11-15T16:39:24Z","closed_at":null,"author_association":"NONE","body":"Hi\r\nI setup LDAP integration as described in Presto & Terrada documentation with a local openldap server on the same host as presto coordinator.\r\nI keep on getting the same error  :\r\n\r\n```\r\n[hadoop@ip-123-45-67-890 ~]$java -Djavax.net.debug=ssl -jar $PRESTO_HOME/bin/presto-cli-0.170-executable --server https://prestodb.issueexample.com.com:8443  --user user1 --password  --catalog hive --schema default --keystore-path /home/hadoop/certificates/myserver.keystore --keystore-password <passwd>\r\n\r\nhttp-client-anonymous1-26, fatal error: 46: General SSLEngine problem\r\njava.security.cert.CertificateException: No name matching prestodb.issueexample.com found `\r\n\r\n```\r\n\r\nJava ssl log shows my certificates are found :\r\n```\r\n***\r\nadding as trusted cert:\r\n  Subject: CN=<hostname>, OU=PositiveSSL, OU=Domain Control Validated\r\n  Issuer:  CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\r\n  Algorithm: RSA; Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\r\n  Valid from Fri Jul 21 00:00:00 UTC 2017 until Sat Jul 21 23:59:59 UTC 2018\r\n```\r\n\r\nCertificates I'm using are found in the keystore :\r\n```\r\n[hadoop@ip-123-45-67-890 ~]$ keytool -list -alias prestodb.issueexample.com -keystore /home/hadoop/certificates/myserver.keystore\r\nEnter keystore password:\r\nprestodb.issueexample.com, Jul 21, 2017, trustedCertEntry,\r\nCertificate fingerprint (SHA1): xx:xx:xx:xx:xxx...\r\n```\r\n\r\nOpenldap is configure locally with the same certificates as my presto keystore: \r\n**slapd.conf**\r\n```\r\nTLSCACertificatePath /home/hadoop/certificates/cacertificate.cer\r\nTLSCertificateFile /home/hadoop/certificates/certificate.pem\r\nTLSCertificateKeyFile /home/hadoop/certificates/certificateKey.pem\r\n```\r\n**cn\\=config.ldif**\r\n\r\n```\r\nolcTLSCACertificatePath: /home/hadoop/certificates/cacertificate.pem\r\nolcTLSCertificateFile: /home/hadoop/certificates/certificate.pem\r\nolcTLSCertificateKeyFile: /home/hadoop/certificates/certificateKey.pem\r\n```\r\n\r\nI dont have kerberos setup.\r\nDo i need it ? There's a line in the ldap documentation talknig about a principal : \r\n> the alias in the keytool command line should match the principal that the Presto coordinator will use.\r\n\r\nApart from that, I'm not sure what i'm doing wrong and would really appreciate some guidance to debug.\r\nAlso, is there anyway to have **basic** user/password working with Presto, even without LDAP ?\r\n\r\nThank you !\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/prestodb/presto/issues/comments/439105424","html_url":"https://github.com/prestodb/presto/issues/8569#issuecomment-439105424","issue_url":"https://api.github.com/repos/prestodb/presto/issues/8569","id":439105424,"node_id":"MDEyOklzc3VlQ29tbWVudDQzOTEwNTQyNA==","user":{"login":"BourneYu","id":15730246,"node_id":"MDQ6VXNlcjE1NzMwMjQ2","avatar_url":"https://avatars2.githubusercontent.com/u/15730246?v=4","gravatar_id":"","url":"https://api.github.com/users/BourneYu","html_url":"https://github.com/BourneYu","followers_url":"https://api.github.com/users/BourneYu/followers","following_url":"https://api.github.com/users/BourneYu/following{/other_user}","gists_url":"https://api.github.com/users/BourneYu/gists{/gist_id}","starred_url":"https://api.github.com/users/BourneYu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BourneYu/subscriptions","organizations_url":"https://api.github.com/users/BourneYu/orgs","repos_url":"https://api.github.com/users/BourneYu/repos","events_url":"https://api.github.com/users/BourneYu/events{/privacy}","received_events_url":"https://api.github.com/users/BourneYu/received_events","type":"User","site_admin":false},"created_at":"2018-11-15T16:39:24Z","updated_at":"2018-11-15T16:39:24Z","author_association":"NONE","body":"Hi @kbajda @anusudarsan ,I install Presto(v0.213) and setup AD(LDAPS) integration as described in https://prestodb.io/docs/current/security/ldap.html#presto-cli-execution .\r\nJava Version: java-1.8.0-openjdk-1.8.0.191.b12\r\n\r\nbin/launcher run --verbose,I getting the below error :\r\nError injecting constructor, java.lang.RuntimeException: javax.naming.CommunicationException: anonymous bind failed: ds.dev.opg.cn:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching ds.dev.opg.cn found.\r\n\r\n### The steps are as follows:\r\n\r\n- step1: vim /etc/openldap/ldap.conf\r\n           TLS_REQCERT allow\r\n           TLSVerifyClient allow\r\n\r\n- step2:hostname\r\n           ip-10-205-92-157.cn-north-1.compute.internal\r\n\r\n- step3:keytool -import -keystore  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.amzn2.x86_64/jre/lib/security/cacerts -trustcacerts -alias ldap_server -file /home/ec2-user/ssl_ldaps.crt\r\n\r\n- step4:keytool -genkeypair -alias presto -keyalg RSA -keystore /etc/presto/keystore.jks\r\n\r\n### configuration files are as follows:\r\netc/config.properties:\r\ncoordinator=true\r\nnode-scheduler.include-coordinator=false\r\nhttp-server.http.port=8080\r\ndiscovery-server.enabled=true\r\ndiscovery.uri=http://10.205.92.157:8080\r\nquery.max-memory=1PB\r\nquery.max-memory-per-node=2994MB\r\nquery.max-total-memory-per-node=2994MB\r\n\r\nhttp-server.authentication.type=PASSWORD\r\nhttp-server.https.enabled=true\r\nhttp-server.https.port=8843\r\nhttp-server.https.keystore.path=/etc/presto/keystore.jks\r\nhttp-server.https.keystore.key=changeit\r\n\r\netc/password-authenticator.properties :\r\npassword-authenticator.name=ldap\r\nldap.url=ldaps://ds.dev.opg.cn:636\r\nldap.user-bind-pattern=${USER}@ds.dev.opg.cn\r\nldap.user-base-dn=DC=ds,DC=dev,DC=opg,DC=cn\r\n\r\n### Following the advice (https://github.com/prestodb/presto/pull/11714/files/77aa30df30bce996a23d07f511d3de0ca4df5822), I modified the code and redeployed it. Presto started successfully, but when logging in via https, I reported the following error:\r\n`java.lang.RuntimeException: Authentication error\r\n\tat com.facebook.presto.server.security.PasswordAuthenticator.authenticate(PasswordAuthenticator.java:71)\r\n\tat com.facebook.presto.server.security.AuthenticationFilter.doFilter(AuthenticationFilter.java:80)\r\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)\r\n\tat io.airlift.http.server.TraceTokenFilter.doFilter(TraceTokenFilter.java:64)\r\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)\r\n\tat io.airlift.http.server.TimingFilter.doFilter(TimingFilter.java:52)\r\n\tat org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)\r\n\tat org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)\r\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146)\r\n\tat org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:740)\r\n\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)\r\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257)\r\n\tat org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1340)\r\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203)\r\n\tat org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)\r\n\tat org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201)\r\n\tat org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1242)\r\n\tat org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144)\r\n\tat org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)\r\n\tat org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:174)\r\n\tat org.eclipse.jetty.server.handler.HandlerList.handle(HandlerList.java:61)\r\n\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)\r\n\tat org.eclipse.jetty.server.Server.handle(Server.java:503)\r\n\tat org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:364)\r\n\tat org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)\r\n\tat org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305)\r\n\tat org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)\r\n\tat org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:411)\r\n\tat org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:305)\r\n\tat org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:159)\r\n\tat org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)\r\n\tat org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)\r\n\tat org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333)\r\n\tat org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310)\r\n\tat org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168)\r\n\tat org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:126)\r\n\tat org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:366)\r\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:765)\r\n\tat org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:683)\r\n\tat java.lang.Thread.run(Thread.java:748)\r\nCaused by: com.google.common.util.concurrent.UncheckedExecutionException: java.lang.RuntimeException: Authentication error: user:test password:Bestv001\r\n\tat com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2052)\r\n\tat com.google.common.cache.LocalCache.get(LocalCache.java:3943)\r\n\tat com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:3967)\r\n\tat com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4952)\r\n\tat com.google.common.cache.LocalCache$LocalLoadingCache.getUnchecked(LocalCache.java:4958)\r\n\tat com.facebook.presto.password.LdapAuthenticator.createAuthenticatedPrincipal(LdapAuthenticator.java:90)\r\n\tat com.facebook.presto.server.security.PasswordAuthenticator.authenticate(PasswordAuthenticator.java:65)\r\n\t... 39 more\r\n`\r\n\r\nThanks in advance!!!"}}
{"actor":{"display_login":"BourneYu"}}