prestodb/presto · error · PrestoException

HIVE_RANGER_SERVER_ERROR

HIVE_RANGER_SERVER_ERROR

Error message

Unable to fetch policies from %s hive service end point

What it means

The HTTP response from the Ranger admin's policies endpoint could not be deserialized into ServicePolicies (IOException), thrown as PrestoException HIVE_RANGER_SERVER_ERROR. Either the request failed at transport level or the body was not valid/expected JSON.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/security/ranger/RangerBasedAccessControl.java:143

        }
        catch (Exception e) {
            throw new RuntimeException("Unable to query ranger service ", e);
        }
    }

    private ServicePolicies getHiveServicePolicies(RangerBasedAccessControlConfig config)
    {
        URI uri = uriBuilderFrom(URI.create(config.getRangerHttpEndPoint()))
                .appendPath(RANGER_REST_POLICY_MGR_DOWNLOAD_URL + "/" + config.getRangerHiveServiceName())
                .build();
        Request request = setContentTypeHeaders(prepareGet())
                .setUri(uri)
                .build();
        try {
            return OBJECT_MAPPER.readValue(httpClient.execute(request, createStringResponseHandler()).getBody(), ServicePolicies.class);
        }
        catch (IOException e) {
            throw new PrestoException(HIVE_RANGER_SERVER_ERROR, format("Unable to fetch policies from %s hive service end point", config.getRangerHiveServiceName()), e);
        }
    }

    private Users getUsers(RangerBasedAccessControlConfig config)
    {
        URI uri = uriBuilderFrom(URI.create(config.getRangerHttpEndPoint()))
                .appendPath(RANGER_REST_USER_GROUP_URL)
                .build();
        Request request = setContentTypeHeaders(prepareGet())
                .setUri(uri)
                .build();

        return httpClient.execute(request, createJsonResponseHandler(USER_INFO_CODEC));
    }

    private static Request.Builder setContentTypeHeaders(Request.Builder requestBuilder)
    {
        return requestBuilder

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify ranger.hive.service.name matches a real Ranger service (check the policies URL manually)
2. Manually curl the policies endpoint and validate the JSON response
3. Check Ranger admin version compatibility with the Presto Ranger plugin
4. Inspect network path (proxy/LB) for response truncation
5. Fix the endpoint URL or auth so Ranger returns the expected JSON

Example fix

// before
ranger.hive.service.name=hive_cluster
// after
ranger.hive.service.name=cm_hive

// preflight: confirm the policies endpoint returns JSON
String body = httpGet(rangerEndPoint + "/service/plugins/policies?serviceName=" + serviceName);
new JSONParser().parse(body); // throws if not valid JSON

try {
    runQuery();
} catch (PrestoException e) {
    if ("HIVE_RANGER_SERVER_ERROR".equals(e.getErrorCode().getName())
            && e.getMessage().startsWith("Unable to fetch policies from")) {
        // verify service name and re-fetch policies after Ranger recovers
    } else throw e;
}

When it happens

Trigger: getHiveServicePolicies executes the HTTP GET to the Ranger REST endpoint during RangerBasedAccessControl construction and OBJECT_MAPPER.readValue fails to parse the response body, or the connection breaks mid-read.

Common situations: Wrong ranger.hive.service.name causing a 404/error page body; Ranger admin returning HTML error pages; proxy or LB truncating responses; incompatible Ranger version returning a different policy JSON schema.

Related errors

• HIVE_RANGER_SERVER_ERROR
• Unable to query ranger service
• HIVE_CORRUPTED_COLUMN_STATISTICS
• Response does not contain a JSON value
• Illegal character ':' found in username

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/8bfd4746745340d2. Report an issue: GitHub.