How to run Oozie workfllow or action as another user?

[#1]

Hello,

Using Hue and Oozie, how can I run a specific workflow or action within a workflow as another user?

I have tried the following:

1. Workflow Properties > Oozie parameters > user.name - this has no effect
2. Workflow Properties > Hadoop job properties > user.name - this fails with an error
3. Action > Job properties > user.name - this fails with an error

The error message for 2 and 3 is as follows:

ErrorType [FAILED], ErrorCode [JA010], Message [JA010: Property [user.name] not allowed in action [inline configuration] configuration]
org.apache.oozie.action.ActionExecutorException: JA010: Property [user.name] not allowed in action [inline configuration] configuration
	at org.apache.oozie.action.hadoop.JavaActionExecutor.checkForDisallowedProps(JavaActionExecutor.java:198)
	at org.apache.oozie.action.hadoop.JavaActionExecutor.parseJobXmlAndConfiguration(JavaActionExecutor.java:451)
	at org.apache.oozie.action.hadoop.JavaActionExecutor.setupActionConf(JavaActionExecutor.java:468)
	at org.apache.oozie.action.hadoop.ShellActionExecutor.setupActionConf(ShellActionExecutor.java:55)
	at org.apache.oozie.action.hadoop.JavaActionExecutor.submitLauncher(JavaActionExecutor.java:893)
	at org.apache.oozie.action.hadoop.JavaActionExecutor.start(JavaActionExecutor.java:1145)
	at org.apache.oozie.command.wf.ActionStartXCommand.execute(ActionStartXCommand.java:228)
	at org.apache.oozie.command.wf.ActionStartXCommand.execute(ActionStartXCommand.java:63)
	at org.apache.oozie.command.XCommand.call(XCommand.java:281)
	at org.apache.oozie.service.CallableQueueService$CompositeCallable.call(CallableQueueService.java:323)
	at org.apache.oozie.service.CallableQueueService$CompositeCallable.call(CallableQueueService.java:252)
	at org.apache.oozie.service.CallableQueueService$CallableWrapper.run(CallableQueueService.java:174)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:745)

Any suggestions?

Thanks,

Martin

[#2]

we have already tried that.

[#3]

@sgiri - This has already been answered above. If you use un-secure YARN, all your containers and the commands the container runs (such as in shell action) will run as the "yarn" user (i.e. the user your NodeManager daemon runs as).

If you want to run containers in YARN as the actual submitting user, use the LinuxContainerExecutor instead. The caveat of using it is that you need your user accounts available on all NodeManagers so a setuid can be done against them when spawning the container processes.