Linux does not like those pesky whitespaces. You will need to try using LDAP auth and integration through CDH. Hadoop has the LDAP based group mapping. I don't recommend using it, in general but if you can't/won't change the group names... Hive and Impala both have LDAP auth as well.
Simplest route, from the Hadoop side, is to change the group names.
Yes, we are using LDAP authentication. But we do have some existing AD groups with spaces in the names. Looks like we either need to create new AD Groups (without a space) or one of the tools like SSSD or Centrify to sync between LDAP/AD and linux.