question Re: Owner Group Write Permision to an HDFS path in Support Questions

Owner Group Write Permision to an HDFS path

Seaport — Mon, 10 Feb 2020 18:56:40 GMT

I have run the following test case several times and got the same result.
Context:
1. My HDP cluster uses the simple mode to determine user identity. Kerberos is not enabled.
2. Below is the permission on hdfs folder /data/test

drwxrwxr-x - hdfs hadoop 0 2020-02-07 13:33 /data/test

So hdfs (the super user) is the owner and hadoop is the owner group. Both the owner user and owner group has write permission on the /data/test folder.

Steps:

On an edge node, I used ID command to confirm that the logged on user "testuser" is in hadoop group.

$ id uid=1018(testuser) gid=1003(hadoop) groups=1003(hadoop),10(wheel), 1002(hdfs) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

However, testuser still ran into "Permission Denied".

$ hadoop fs -put ./emptyfile1.txt /data/test put: Permission denied: user=testuser, access=WRITE, inode="/data/test":hdfs:hadoop:drwxrwxr-x

Then I used hdfs account to changed the folder owner to be testuser.

$ hadoop fs -chown testuser /data/test

From the same edge node, now testuser ran put command successfully.

Here is my question: why testuser cannot write to the hdfs folder via the owner group permissions?

Re: Owner Group Write Permision to an HDFS path

GangWar — Mon, 10 Feb 2020 19:49:10 GMT

What's the result of below command with respect to test user?

id -Gn testuser

Re: Owner Group Write Permision to an HDFS path

Seaport — Mon, 10 Feb 2020 19:51:45 GMT

@GangWar Here it is.

$ id -Gn testuser
hadoop wheel hdfs

Re: Owner Group Write Permision to an HDFS path

Seaport — Wed, 19 Feb 2020 21:29:26 GMT

Finally, I figured out what is going on.

The root cause is that, I only set up testuser on edge nodes, not the name node.

I looked into this page, https://hadoop.apache.org/docs/r3.1.1/hadoop-project-dist/hadoop-common/GroupsMapping.html, which shows that "For HDFS, the mapping of users to groups is performed on the NameNode. Thus, the host system configuration of the NameNode determines the group mappings for the users."
After I created the user on the NameNode and ran the command

hdfs dfsadmin -refreshUserToGroupsMappings

the copy is successful and there is no permission-denied error.