question Re: Superuser privilege for new HDFS Admin doesn't work in Archives of Support Questions (Read Only) https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162682#M41286 <P>This information (as many others) is wrong in the official HDP Security course from Hortonworks. In the HDFS Encryption presentations of the course it states that to create an HDFS admin user to manage EZ is enough with setting the following </P><P>(copy/paste here):</P><PRE>dfs.cluster.administrators=hdfs,encrypter hadoop.kms.blacklist.DECRYPT_EEK=hdfs,encrypter</PRE> Tue, 30 Oct 2018 01:48:44 GMT lvazquez 2018-10-30T01:48:44Z Superuser privilege for new HDFS Admin doesn't work https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162677#M41281 <P>Followed instructions here <A href="http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.0/bk_security/content/hdfs-encr-appendix.html" target="_blank">http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.0/bk_security/content/hdfs-encr-appendix.html</A> to create a new hdfs admin for the purpose of making TDE zones creation work. </P><PRE>[opt1@tsys1 ~]$ groups domain_users operator[opt1@tsys1 ~]$ hdfs dfsadmin -reportat org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:90) at org.apache.hadoop.hdfs.tools.DFSAdmin.main(DFSAdmin.java:2107) report: Access denied for user opt1. Superuser privilege is required</PRE><P>Property values in Ambari shown below:</P><P>dfs.permissions.superusergroup=hdfs,operator</P><P>dfs.cluster.administrators=hdfs,opt1</P><P>hadoop.kms.blacklist.DECRYPT_EEK=opt1</P> Wed, 21 Sep 2016 04:36:58 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162677#M41281 rgarcia 2016-09-21T04:36:58Z Re: Superuser privilege for new HDFS Admin doesn't work https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162678#M41282 <P>I believe dfs.permissions.superusergroup can only contain a single value. If you change dfs.permissions.superusergroup to just 'operator' is the behavior as expected?</P><P>User hdfs will have still normal superuser access with this configuration change, since it starts the NameNode process.</P> Wed, 21 Sep 2016 05:07:13 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162678#M41282 slachterman 2016-09-21T05:07:13Z Re: Superuser privilege for new HDFS Admin doesn't work https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162679#M41283 <P>tried removing hdfs and just left opt1 in the administrator property but still getting the same issue.</P> Wed, 21 Sep 2016 08:47:03 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162679#M41283 rgarcia 2016-09-21T08:47:03Z Re: Superuser privilege for new HDFS Admin doesn't work https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162680#M41284 <P>The change I am suggesting is dfs.permissions.superusergroup=operator</P> Wed, 21 Sep 2016 08:48:24 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162680#M41284 slachterman 2016-09-21T08:48:24Z Re: Superuser privilege for new HDFS Admin doesn't work https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162681#M41285 <P>removed hdfs in the superusergroup as well and just left operator, and it worked.</P> Wed, 21 Sep 2016 09:07:13 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162681#M41285 rgarcia 2016-09-21T09:07:13Z Re: Superuser privilege for new HDFS Admin doesn't work https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162682#M41286 <P>This information (as many others) is wrong in the official HDP Security course from Hortonworks. In the HDFS Encryption presentations of the course it states that to create an HDFS admin user to manage EZ is enough with setting the following </P><P>(copy/paste here):</P><PRE>dfs.cluster.administrators=hdfs,encrypter hadoop.kms.blacklist.DECRYPT_EEK=hdfs,encrypter</PRE> Tue, 30 Oct 2018 01:48:44 GMT https://community.cloudera.com/t5/Archives-of-Support-Questions/Superuser-privilege-for-new-HDFS-Admin-doesn-t-work/m-p/162682#M41286 lvazquez 2018-10-30T01:48:44Z