question Re: cannot create user directory after kerberos in Archives of Support Questions (Read Only)

cannot create user directory after kerberos

yongie — Tue, 24 Jul 2018 14:21:50 GMT

Hi there,

I just enable Kerberos on my test cluster, however after enabling kerberos, I am not able to create /user/test directory anymore due to permission error.

hadoop fs -mkdir /user/test
mkdir: Permission denied: user=admin, access=WRITE, inode="/user":hdfs:supergroup:drwxr-xr-x

Anyway to fix it?

Thanks

Re: cannot create user directory after kerberos

saranvisa — Tue, 24 Jul 2018 09:09:53 GMT

@yongie

switch to hdfs user and try again

Re: cannot create user directory after kerberos

bgooley — Tue, 24 Jul 2018 19:15:23 GMT

@yongie,

The Permission Denied message indicates that your hadoop command is authenticating as the user "admin". As you can see, the user "admin" does not have previlige to write to the /user directory.

In order to be able to have non-hdfs user write to that /user directory with the permissions as they are, that "admin" user will need to be a superuser.

If you are not interested in having outher users as superusers, then the other option is to kinit as hdfs

Basically, you need to create a user in your KDC with the name "hdfs" and with the userprincipalname hdfs@realm.

See this page for details all that I mentioned above:

https://www.cloudera.com/documentation/enterprise/latest/topics/cm_sg_s5_hdfs_principal.html

Ben

Re: cannot create user directory after kerberos

yongie — Fri, 27 Jul 2018 07:17:44 GMT

@bgooley

It does the trick by creating hdfs user in kerberos, however, for the proper setup do I need to change the supergroup? and assign user to supergroup?

Re: cannot create user directory after kerberos

adiz — Fri, 19 Mar 2021 19:37:30 GMT

Ohh My God, This worked
You are a lifesaver.

Re: cannot create user directory after kerberos

adiz — Fri, 19 Mar 2021 19:49:15 GMT

that worked but when I tried to fire command from admin user (commands like --- hdfs dfs -cp file /user/admin or hdfs dfs -ls /user/)
it's not allowing me

giving below error

WARN security.UserGroupInformation: PriviledgedActionException as:admin (auth:KERBEROS) cause:javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]