apache / apache/kyuubi

[Bug] get errors when i use "curl -v -X 'POST' --negotiate -u : 'https://hostname:10099/api/v1/sessions' to start a session

Open
#5,460 16 comments 0 reactions 0 assignees View on GitHub
kind:bug priority:major
Dominant language
Scala
Stars
2.4k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the bug

i used curl to post rest request for creating a sessions , but both http and https didn't work.

curl -v debug info show as follows:

**#** curl -v -X 'POST' --negotiate -u : 'https://myhostname:10099/api/v1/sessions'
* About to connect() to myhostname port 10099 (#0)
* Trying 10.30.17.237...
* Connected to myhostname (10.30.17.237) port 10099 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* NSS error -12263 (SSL_ERROR_RX_RECORD_TOO_LONG)
* SSL received a record that exceeded the maximum permissible length.
* Closing connection 0
curl: (35) SSL received a record that exceeded the maximum permissible length.

**#** curl -v -X 'POST' --negotiate -u : 'http://myhostname:10099/api/v1/sessions'
* About to connect() to myhostname port 10099 (#0)
* Trying 10.30.17.237...
* Connected to myhostname (10.30.17.237) port 10099 (#0)
> POST /api/v1/sessions HTTP/1.1
> User-Agent: curl/7.29.0
> Host: myhostname:10099
> Accept: */*
>
< HTTP/1.1 500 Internal Server Error
< Date: Wed, 18 Oct 2023 01:49:37 GMT
< Content-Type: application/json
< Content-Length: 16
< Server: Jetty(9.4.52.v20230823)
<
* Connection #0 to host myhostnameleft intact
{"message":null}

It seems like that jetty server is not configed with ssl on, but i don't know how to fix it.

Thanks very much for your helps!

### Affects Version(s)

master/1.7.0

### Kyuubi Server Log Output

_No response_

### Kyuubi Engine Log Output

_No response_

### Kyuubi Server Configurations

```yaml
kyuubi.authentication=KERBEROS
kyuubi.kinit.principal=hive/myhostname@BIGDATA.CTY.CN
kyuubi.kinit.keytab=/etc/security/keytabs/hive.keytab

kyuubi.backend.server.event.loggers=JSON
kyuubi.backend.server.event.json.log.path=/var/log/kyuubi/event

kyuubi.ha.addresses=nm-bigdata-030017237.ctc.local:2181,nm-bigdata-030017238.ctc.local:2181,nm-bigdata-030017239.ctc.local:2181
kyuubi.ha.namespace=kyuubi_root

kyuubi.frontend.rest.bind.host=10.30.17.237
kyuubi.frontend.bind.host=10.30.17.237
kyuubi.frontend.protocols=REST,THRIFT_BINARY

kyuubi.spnego.keytab=/etc/security/keytabs/HTTP.keytab
kyuubi.spnego.principal=HTTP/myhostname@BIGDATA.CTY.CN

kyuubi.server.administrators=anonymous
```

### Kyuubi Engine Configurations

_No response_

### Additional context

_No response_

### Are you willing to submit PR?

- [x] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the REST endpoint at /api/v1/sessions alongside the kyuubi.frontend.rest.bind.host, kyuubi.frontend.protocols, and kyuubi.spnego.* settings shown in the report. Reproduce both curl requests with server logs enabled, then determine the configuration or server behavior responsible for the TLS and HTTP 500 responses; done means a session can be created successfully using the intended protocol.

Written by the indexing model from the issue text.

Assessment

Domain
api, authentication, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.