Trying to connect to Impala server that uses kerberos using the ibis

Question

I'm trying to connect to Impala server that uses kerberos using the ibis.impala.connect like so:

import ibis

client = ibis.impala.connect(host='grid.company.corp',
                             port=21050,
                             auth_mechanism='GSSAPI',
                             use_ssl=True,
                             kerberos_service_name='impala',
                             ca_cert='D:\Users\USERNAME\Documents\cachain')

But I keep getting the following error:

D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\ibis\sql\postgres\compiler.py:175: UserWarning: locale specific date formats (%c, %x, %X) are not yet implemented for Windows
  'for %s' % platform.system()
Traceback (most recent call last):
  File "D:\Users\USERNAME\Documents\Jupyter Notebooks\PPCs\impyla.py", line 9, in <module>
    ca_cert='D:\Users\USERNAME\Documents\cachain')
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\ibis\impala\api.py", line 97, in connect
    con = ImpalaConnection(pool_size=pool_size, **params)
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\ibis\impala\client.py", line 87, in __init__
    self.ping()
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\ibis\impala\client.py", line 182, in ping
    self._new_cursor()
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\ibis\impala\client.py", line 167, in _new_cursor
    con = impyla.connect(database=self.database, **params)
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\impala\dbapi.py", line 147, in connect
    auth_mechanism=auth_mechanism)
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\impala\hiveserver2.py", line 658, in connect
    transport.open()
  File "build\bdist.win-amd64\egg\thrift_sasl\__init__.py", line 61, in open
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\thrift\transport\TSSLSocket.py", line 120, in open
    self._validate_cert()
  File "D:\Archivos de programa\Miniconda2\envs\anaconda\lib\site-packages\thrift\transport\TSSLSocket.py", line 157, in _validate_cert
    'provided commonName "%s"' % (self.host, certhost))
thrift.transport.TTransport.TTransportException: Hostname we connected to "grid.company.corp" doesn't match certificate provided commonName "server.company.corp"

Running Windows 7 with python 2.7 installed using Anaconda.

I have the Impala ODBC set up and it works fine.

Looks like the Impala ODBC driver does **not** check the authenticity of SSL certificates. — Samson Scharfrichter, Sep 20 '16 at 08:48
RTFM: from http://docs.ibis-project.org/generated/ibis.impala.api.connect.html _`ca_cert` : string, Local path to 3rd party CA certificate or copy of server certificate for self-signed certificates. **If SSL is enabled, but this argument is None, then certificate validation is skipped**_ — Samson Scharfrichter, Sep 20 '16 at 08:50
Hey @SamsonScharfrichter, thanks for the reply, but I'm not sure what you mean, the `ca_cert` is there in the parameters, so SSL is indeed enabled and the `ca_cert` parameter is NOT None. — ZuluagaSD, Sep 20 '16 at 12:52
Nonsense. SSL is enabled because of `use_ssl` parameter. Then you **demand** that the SSL certificate be **controlled**, because of `ca_cert` -- but your bloody certificate is INVALID *(does not match the host name)* so **the control fails**, and the connection fails. Either you get a valid certificate, or you remove the control (i.e. remove the `ca_cert` parameter). — Samson Scharfrichter, Sep 20 '16 at 16:47
Please control your temper, Mister Scharfrichter. Indeed, ZuluagaSD was providing the ca_cert argument with a value. if you were suggesting that he should try ca_cert=None and yet use_ssl=True or any other combination, you could have said so explicitly. Also, ZuluagaSD is explicitely stating that he has ODBC set up and works fine. Presummably he is using the certificate when connecting through ODBC and his connection without it does not work. Can the certificate be invalid as you suggest, and yet yield you a working connection through ODBC even if that driver doesn't check? — Mateo, Sep 29 '16 at 22:14

Trying to connect to Impala server that uses kerberos using the ibis

0 Answers0