[RANGER-4806] With java 17 the audit spool exception is seen if solr is not reachable.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0, 2.5.0
• Component/s: Ranger
• Assignee: Monika kachhadiya
• Reporter: Monika kachhadiya
• Created: 28/May/24 10:09
• Updated: 28/Jun/24 21:56
• Resolved: 18/Jun/24 17:15

Description

With java 17 the audit spool exception is seen if solr is not reachable. 
 

 
 ERROR AuditFileSpool: Error writing to file. event=AuthzAuditEvent
com.google.gson.JsonIOException: Failed making field 'java.nio.charset.Charset#name' accessible; either increase its visibility or write a custom TypeAdapter for its declaring type.
at com.google.gson.internal.reflect.ReflectionHelper.makeAccessible(ReflectionHelper.java:38) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.getBoundFields(ReflectiveTypeAdapterFactory.java:286) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.create(ReflectiveTypeAdapterFactory.java:130) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.getAdapter(Gson.java:556) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.createBoundField(ReflectiveTypeAdapterFactory.java:160) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.getBoundFields(ReflectiveTypeAdapterFactory.java:294) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.create(ReflectiveTypeAdapterFactory.java:130) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.getAdapter(Gson.java:556) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.createBoundField(ReflectiveTypeAdapterFactory.java:160) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.getBoundFields(ReflectiveTypeAdapterFactory.java:294) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.create(ReflectiveTypeAdapterFactory.java:130) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.getAdapter(Gson.java:556) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.createBoundField(ReflectiveTypeAdapterFactory.java:160) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.getBoundFields(ReflectiveTypeAdapterFactory.java:294) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.create(ReflectiveTypeAdapterFactory.java:130) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.getAdapter(Gson.java:556) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.createBoundField(ReflectiveTypeAdapterFactory.java:160) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.getBoundFields(ReflectiveTypeAdapterFactory.java:294) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.create(ReflectiveTypeAdapterFactory.java:130) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.getAdapter(Gson.java:556) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.createBoundField(ReflectiveTypeAdapterFactory.java:160) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.getBoundFields(ReflectiveTypeAdapterFactory.java:294) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.create(ReflectiveTypeAdapterFactory.java:130) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.getAdapter(Gson.java:556) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.createBoundField(ReflectiveTypeAdapterFactory.java:160) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.getBoundFields(ReflectiveTypeAdapterFactory.java:294) ~[gson-2.10.1.jar:?]
at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory.create(ReflectiveTypeAdapterFactory.java:130) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.getAdapter(Gson.java:556) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.toJson(Gson.java:834) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.toJson(Gson.java:812) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.toJson(Gson.java:759) ~[gson-2.10.1.jar:?]
at com.google.gson.Gson.toJson(Gson.java:736) ~[gson-2.10.1.jar:?]
at org.apache.ranger.audit.queue.AuditFileSpool.saveIndexFile(AuditFileSpool.java) ~[ranger-plugins-audit-10.22.0.2.jar:10.22.0.2]
at org.apache.ranger.audit.queue.AuditFileSpool.getLogFileStream(AuditFileSpool.java) ~[ranger-plugins-audit-10.22.0.2.jar:10.22.0.2]
at org.apache.ranger.audit.queue.AuditFileSpool.stashLogs(AuditFileSpool.java) [ranger-plugins-audit-10.22.0.2.jar:10.22.0.2]
at org.apache.ranger.audit.queue.AuditFileSpool.stashLogs(AuditFileSpool.java) [ranger-plugins-audit-10.22.0.2.jar:10.22.0.2]
at org.apache.ranger.audit.queue.AuditBatchQueue.runLogAudit(AuditBatchQueue.java) [ranger-plugins-audit-10.22.0.2.jar:10.22.0.2]
at org.apache.ranger.audit.queue.AuditBatchQueue.run(AuditBatchQueue.java) [ranger-plugins-audit-10.22.0.2.jar:10.22.0.2]
at java.lang.Thread.run(Thread.java:840) [?:?]
Caused by: java.lang.reflect.InaccessibleObjectException: Unable to make field private final java.lang.String java.nio.charset.Charset.name accessible: module java.base does not "opens java.nio.charset" to unnamed module @48ae9b55
at java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:354) ~[?:?]
at java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:297) ~[?:?]
at java.lang.reflect.Field.checkCanSetAccessible(Field.java:178) ~[?:?]
at java.lang.reflect.Field.setAccessible(Field.java:172) ~[?:?]
at com.google.gson.internal.reflect.ReflectionHelper.makeAccessible(ReflectionHelper.java:35) ~[gson-2.10.1.jar:?] 

 
 
The root cause seems to be as mentioned here:
 
Similar to #1963 and other existing reports. Apparently you are deserializing a JDK class (java.security.KeyFactory) without having specified a custom type adapter for it. Gson will then by default use a reflection based type adapter. You have to write a custom type adapter to solve this issue or move to jackson fasterxml.
 
The reason why this is causing an exception for JDK 17 is because JDK internals are now strongly encapsulated (see JEP 403).
In general you should avoid using reflection based serialization and deserialization for classes which you do not control because you rely on their implementation details which could change at any point. (Unfortunately Gson currently does not have a setting for easily blocking such undesired reflective access.)
 

Issue Links

• breaks: RANGER-4836 Ranger Usersync failing due to java.lang.NoClassDefFoundError