[HADOOP-12785] [Handling exceptions] LdapGroupsMapping.getGroups() do not provide information about root cause

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 2.7.1
• Component/s: security
• Labels: easyfix

Environment

Operating system: CentOS Linux 7 (7.1.1503)
Platform: HDP 2.3.4.0, Ambari 2.1.2

• Assignee: Wei-Chiu Chuang
• Reporter: Mukhadin Buzdov
• Created: 09/Feb/16 10:19
• Updated: 02/Oct/19 17:15

Description

CommunicationException and NamingException are not logged in LdapGroupsMapping.getGroups().

LdapGroupsMapping.java

  public synchronized List<String> getGroups(String user) throws IOException {
    List<String> emptyResults = new ArrayList<String>();
    // ...
    try {
      return doGetGroups(user);
    } catch (CommunicationException e) {
      LOG.warn("Connection is closed, will try to reconnect");
    } catch (NamingException e) {
      LOG.warn("Exception trying to get groups for user " + user + ": " + e.getMessage());
      return emptyResults;
    }
    //...
    return emptyResults;
  }

It is not possible to understand LDAP level failures.

Issue Links

• is related to: HADOOP-12838 Add metrics for LDAP-specific group mapping resolution time
• links to: LDAP Status Codes and JNDI Exceptions