Reply
Explorer
Posts: 19
Registered: ‎09-18-2015

Delay in propagation of OS level group mappings

Hi everybody,

 

I've got a strange situation regarding the HDFS user/group privileges. When I add a user to a second (or third, forth, ...) group, it takes some time for HDFS to notice the OS level change. Example:

 

# Notice the first timestamp - the moment when the change was made

[root@hostname ~]# date; usermod -G user1,test1 user1; id user1
Fri Jan 29 17:19:13 CET 2016
uid=513(user1) gid=513(user1) groups=513(user1),516(test1)

 

# The second timestamp - the moment when the "hdfs groups" command returned the correct group mapping

[root@hostname ~]# date; hdfs groups user1
Fri Jan 29 17:22:54 CET 2016
user1 : user1 test1

 

The same thing happens when I try to remove one of the groups. Does anybody have a clue what could be the reason for this behaviour? CDH v5.4.9 is used with Kerberos/Sentry AA.

Cloudera Employee
Posts: 10
Registered: ‎12-30-2015

Re: Delay in propagation of OS level group mappings

I presume that adding/removing groups is not that frequent of a change, and hopefully you have considered integrating your linux machines to an upstream LDAP provider.

 

Be that as it may, you can also force the NameNode to refresh the user to group mappings by executing the following command:

 

hdfs dfsadmin -refreshUserToGroupsMappings

Explorer
Posts: 19
Registered: ‎09-18-2015

Re: Delay in propagation of OS level group mappings

I'm also hoping that this won't be so frequent, so I don't see it as actual problem. Nevertheless, I'll try the "-refreshUserToGroupsMappings" option to see if it'll make any difference ..

 

Tnx

New Contributor
Posts: 5
Registered: ‎02-08-2016

Re: Delay in propagation of OS level group mappings

I have added a user to two user groups in the OS. The changes are not showing in HDFS even after running the 

hdfs dfsadmin -refreshUserToGroupsMappings

command
 
$groups user1
user1 : users group1 group2 newgroup1 newgroup2
$hdfs groups user1
user1 : users group1 group2 
 
Is there an extra step I need to take?
Announcements