prestodb/presto · critical · RuntimeException

Unable to query ranger service

Error message

Unable to query ranger service 

What it means

During RangerBasedAccessControl construction, fetching the initial ServicePolicies or building RangerAuthorizer failed; the constructor wraps it in a RuntimeException 'Unable to query ranger service '. This aborts catalog initialization, so the Hive catalog with Ranger security fails to start.

Source

Thrown at presto-hive/src/main/java/com/facebook/presto/hive/security/ranger/RangerBasedAccessControl.java:127

            servicePolicies = memoizeWithExpiration(
                    () -> getHiveServicePolicies(config),
                    config.getRefreshPeriod().toMillis(),
                    MILLISECONDS);

            userGroupsMapping = memoizeWithExpiration(
                    () -> getUserGroupsMappings(config),
                    config.getRefreshPeriod().toMillis(),
                    MILLISECONDS);

            userRolesMapping = memoizeWithExpiration(
                    () -> getRolesForUserList(config),
                    config.getRefreshPeriod().toMillis(),
                    MILLISECONDS);

            rangerAuthorizer = new RangerAuthorizer(servicePolicies, config);
        }
        catch (Exception e) {
            throw new RuntimeException("Unable to query ranger service ", e);
        }
    }

    private ServicePolicies getHiveServicePolicies(RangerBasedAccessControlConfig config)
    {
        URI uri = uriBuilderFrom(URI.create(config.getRangerHttpEndPoint()))
                .appendPath(RANGER_REST_POLICY_MGR_DOWNLOAD_URL + "/" + config.getRangerHiveServiceName())
                .build();
        Request request = setContentTypeHeaders(prepareGet())
                .setUri(uri)
                .build();
        try {
            return OBJECT_MAPPER.readValue(httpClient.execute(request, createStringResponseHandler()).getBody(), ServicePolicies.class);
        }
        catch (IOException e) {
            throw new PrestoException(HIVE_RANGER_SERVER_ERROR, format("Unable to fetch policies from %s hive service end point", config.getRangerHiveServiceName()), e);
        }
    }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Fix ranger.http.end-point in the catalog properties and confirm connectivity with curl
2. Verify ranger.hive.service.name matches the service defined in Ranger admin
3. Ensure Ranger admin is running before starting the Presto coordinator
4. Inspect the chained cause (IOException / HTTP error) for the actual failure
5. Fix TLS truststore/auth settings if Ranger uses HTTPS with mutual auth

Example fix

// before (hive.properties)
ranger.http.end-point=http://ranger:9999
// after
ranger.http.end-point=http://ranger-admin.example.com:6080

// preflight before using the catalog
URI ep = URI.create(config.getRangerHttpEndPoint());
try (Socket s = new Socket(ep.getHost(), ep.getPort())) { /* reachable */ }

try {
    Catalog catalog = createHiveCatalogWithRanger(config);
} catch (RuntimeException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("Unable to query ranger service")) {
        // validate endpoint/service name, ensure Ranger is up, then re-deploy
    } else throw e;
}

When it happens

Trigger: Creating the RangerBasedAccessControl connector instance: getHiveServicePolicies HTTP call or RangerAuthorizer setup throws (bad endpoint, connection refused, invalid JSON, missing service).

Common situations: Misconfigured ranger.http.end-point URL; wrong ranger.hive.service.name; Ranger admin down at Presto startup; TLS/auth misconfiguration; firewall blocking coordinator-to-Ranger traffic.

Related errors

• HIVE_RANGER_SERVER_ERROR
• JDBC driver class not found: {config.getJdbcDriverName()}
• NODE_SELECTION_NOT_SUPPORTED
• HIVE_TOO_MANY_OPEN_PARTITIONS
• INVALID_SESSION_PROPERTY

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/841dfb117eb0c3b2. Report an issue: GitHub.