Permission denied: user=yarn, access=WRITE oozie shell action

Generally you will get permission denied error as below when you run oozie shell action without setting environment variable to username who is submitting the oozie workflow.

Permission denied: user=yarn, access=WRITE oozie shell action

Below are my sample configs

workflow.xml

<workflow-app xmlns="uri:oozie:workflow:0.3" name="shell-wf">
<start to="shell-node"/>
<action name="shell-node">
<shell xmlns="uri:oozie:shell-action:0.1">
<job-tracker>${jobTracker}</job-tracker>
<name-node>${nameNode}</name-node>
<configuration>
<property>
<name>mapred.job.queue.name</name>
<value>${queueName}</value>
</property>
</configuration>
<exec>test.sh</exec>
<file>/user/root/test.sh</file>
</shell>
<ok to="end"/>
<error to="fail"/>
</action>
<kill name="fail">
<message>Shell action failed, error message[${wf:errorMessage(wf:lastErrorNode())}]</message>
</kill>
<end name="end"/>
</workflow-app>

job.properties

nameNode=hdfs://sandbox.hortonworks.com:8020
jobTracker=sandbox.hortonworks.com:8050
queueName=default
examplesRoot=examples
oozie.wf.application.path=${nameNode}/user/${user.name}

test.sh shell script

#!/bin/bash
hadoop fs -mkdir /user/root/testdir

Error:

mkdir: Permission denied: user=yarn, access=WRITE, inode="/user/root/testdir":root:hdfs:drwxr-xr-x
Failing Oozie Launcher, Main class [org.apache.oozie.action.hadoop.ShellMain], exit code [1]
log4j:WARN No appenders could be found for logger (org.apache.hadoop.metrics2.impl.MetricsSystemImpl).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.


How to fix this?

To tell oozie not to run container as yarn but as the user who has submitted the workflow, we need to add below variable environment variable in our workflow.xml file

<env-var>HADOOP_USER_NAME=${wf:user()}</env-var>

Modified working workflow.xml file:

<workflow-app xmlns="uri:oozie:workflow:0.3" name="shell-wf">
<start to="shell-node"/>
<action name="shell-node">
<shell xmlns="uri:oozie:shell-action:0.1">
<job-tracker>${jobTracker}</job-tracker>
<name-node>${nameNode}</name-node>
<configuration>
<property>
<name>mapred.job.queue.name</name>
<value>${queueName}</value>
</property>
</configuration>
<exec>test.sh</exec>
<env-var>HADOOP_USER_NAME=${wf:user()}</env-var>
<file>/user/root/test.sh</file>
</shell>
<ok to="end"/>
<error to="fail"/>
</action>
<kill name="fail">
<message>Shell action failed, error message[${wf:errorMessage(wf:lastErrorNode())}]</message>
</kill>
<end name="end"/>
</workflow-app>

Ouptut:

[root@sandbox ~]# hadoop fs -ls -d /user/root/testdir
drwxr-xr-x - root hdfs 0 2016-04-08 07:59 /user/root/testdir
[root@sandbox ~]#