{"record":{"id":"841dfb117eb0c3b2","repo":"prestodb/presto","slug":"unable-to-query-ranger-service","errorCode":null,"errorMessage":"Unable to query ranger service ","messagePattern":"Unable to query ranger service ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"presto-hive/src/main/java/com/facebook/presto/hive/security/ranger/RangerBasedAccessControl.java","lineNumber":127,"sourceCode":"            servicePolicies = memoizeWithExpiration(\n                    () -> getHiveServicePolicies(config),\n                    config.getRefreshPeriod().toMillis(),\n                    MILLISECONDS);\n\n            userGroupsMapping = memoizeWithExpiration(\n                    () -> getUserGroupsMappings(config),\n                    config.getRefreshPeriod().toMillis(),\n                    MILLISECONDS);\n\n            userRolesMapping = memoizeWithExpiration(\n                    () -> getRolesForUserList(config),\n                    config.getRefreshPeriod().toMillis(),\n                    MILLISECONDS);\n\n            rangerAuthorizer = new RangerAuthorizer(servicePolicies, config);\n        }\n        catch (Exception e) {\n            throw new RuntimeException(\"Unable to query ranger service \", e);\n        }\n    }\n\n    private ServicePolicies getHiveServicePolicies(RangerBasedAccessControlConfig config)\n    {\n        URI uri = uriBuilderFrom(URI.create(config.getRangerHttpEndPoint()))\n                .appendPath(RANGER_REST_POLICY_MGR_DOWNLOAD_URL + \"/\" + config.getRangerHiveServiceName())\n                .build();\n        Request request = setContentTypeHeaders(prepareGet())\n                .setUri(uri)\n                .build();\n        try {\n            return OBJECT_MAPPER.readValue(httpClient.execute(request, createStringResponseHandler()).getBody(), ServicePolicies.class);\n        }\n        catch (IOException e) {\n            throw new PrestoException(HIVE_RANGER_SERVER_ERROR, format(\"Unable to fetch policies from %s hive service end point\", config.getRangerHiveServiceName()), e);\n        }\n    }","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-hive/src/main/java/com/facebook/presto/hive/security/ranger/RangerBasedAccessControl.java#L109-L145","documentation":"During RangerBasedAccessControl construction, fetching the initial ServicePolicies or building RangerAuthorizer failed; the constructor wraps it in a RuntimeException 'Unable to query ranger service '. This aborts catalog initialization, so the Hive catalog with Ranger security fails to start.","triggerScenarios":"Creating the RangerBasedAccessControl connector instance: getHiveServicePolicies HTTP call or RangerAuthorizer setup throws (bad endpoint, connection refused, invalid JSON, missing service).","commonSituations":"Misconfigured ranger.http.end-point URL; wrong ranger.hive.service.name; Ranger admin down at Presto startup; TLS/auth misconfiguration; firewall blocking coordinator-to-Ranger traffic.","solutions":["Fix ranger.http.end-point in the catalog properties and confirm connectivity with curl","Verify ranger.hive.service.name matches the service defined in Ranger admin","Ensure Ranger admin is running before starting the Presto coordinator","Inspect the chained cause (IOException / HTTP error) for the actual failure","Fix TLS truststore/auth settings if Ranger uses HTTPS with mutual auth"],"exampleFix":"// before (hive.properties)\nranger.http.end-point=http://ranger:9999\n// after\nranger.http.end-point=http://ranger-admin.example.com:6080","handlingStrategy":"retry","validationCode":"// preflight before using the catalog\nURI ep = URI.create(config.getRangerHttpEndPoint());\ntry (Socket s = new Socket(ep.getHost(), ep.getPort())) { /* reachable */ }","typeGuard":null,"tryCatchPattern":"try {\n    Catalog catalog = createHiveCatalogWithRanger(config);\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Unable to query ranger service\")) {\n        // validate endpoint/service name, ensure Ranger is up, then re-deploy\n    } else throw e;\n}","preventionTips":["Validate ranger.http.end-point and ranger.hive.service.name before deployment","Ensure Ranger admin starts before Presto coordinators (orchestration dependency)","Test connectivity from coordinator hosts with curl during deployment checks","Fix TLS/auth configuration when Ranger uses HTTPS"],"tags":["ranger","hive","startup","network","configuration"],"backgroundTag":"policy-fetch-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}