question {msg":"User 'UserX' not allowed to impersonate ''UserY"} in Support Questions

{msg":"User 'UserX' not allowed to impersonate ''UserY"}

naymar — Tue, 21 Apr 2026 07:54:23 GMT

In a kerberized environment, I am creating a session on Livy with a kerberos ticket of User X and giving proxyUser UserY.

curl -v --negotiate -u : -X POST -H "Content-Type: application/json" -d '{"kind":"spark","proxyUser":"UserY"}' https://server-url:8998/sessions -k

The response I get is that

{msg":"User 'UserX' not allowed to impersonate ''UserY"}

when I initiate a ticket with UserY and

curl -v --negotiate -u : -X POST -H "Content-Type: application/json" -d '{"kind":"spark","proxyUser":"UserY"}' https://server-url:8998/sessions -k

Response I get:

{"id":145,"name":null,"appId":null,"owner":"UserY","state":"starting","kind":"spark","appInfo":{"driverLogUrl":null,"sparkUiUrl":null},"log":["stdout: ","\nstderr: ","\nYARN Diagnostics:.....}

Re: {msg":"User 'UserX' not allowed to impersonate ''UserY"}

jagadeesan — Mon, 04 Jul 2022 23:03:57 GMT

Hi @naymar, to grant Livy the ability to impersonate the originating user, add the following property to <HADOOP_HOME>/etc/hadoop/core-site.xml:

<property>
      <name>hadoop.proxyuser.livy.groups</name>
      <value>*</value>
</property>

<property>
      <name>hadoop.proxyuser.livy.hosts</name>
      <value>*</value>
</property>

Ref: https://docs.cloudera.com/cdp-private-cloud-base/7.1.7/configuration-properties/topics/cm_props_cdh710_coreconfiguration.html
https://docs.cloudera.com/HDPDocuments/HDP2/HDP-2.5.3/bk_command-line-installation/content/grant_livy_impersonate.html

Re: {msg":"User 'UserX' not allowed to impersonate ''UserY"}

VidyaSargur — Tue, 12 Jul 2022 06:12:40 GMT

@naymar, Has the reply helped resolve your issue? If so, can you kindly mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future?