Hue dashboard: hue is not allowed to impersonate hdfs, even with hadoop.proxyuser.hdfs.hosts/user

[#1]

Hello,

I have issues to access Solr search from hue. I have the following error while accessing it :

"RemoteException" : {
    "message" : "User: hue is not allowed to impersonate hdfs",
    "exception" : "AuthorizationException",
    "javaClassName" : "org.apache.hadoop.security.authorize.AuthorizationException"
  }

 "GET /solr/admin/cores?user.name=hue&doAs=hdfs&wt=json HTTP/1.1" 403 223

I already added the following properties in my core-site :

<property>
    <name>hadoop.proxyuser.hdfs.hosts</name>
    <value>*</value>
  </property>
  <property>
    <name>hadoop.proxyuser.hdfs.groups</name>
    <value>*</value>
  </property>

(and to be 100% sure it works i added hue, but i guess it isn't required)
  <property>
    <name>hadoop.proxyuser.hue.hosts</name>
    <value>*</value>
  </property>
  <property>
    <name>hadoop.proxyuser.hue.groups</name>
    <value>*</value>
  </property>

My config is a bit specific and it might be the reason it fails:

- i am in single user mode

- i have two ip adresses : eth0 to link my computer to cm and hue and eth1 to link the 3 nodes

I checked on all my nodes if it had something to do with linux groups and added hue to hdfs, cloudera-scm, username ...

I also checked my hdfs-site.xml and web-hdfs is enabled.

The reason might also be the authentification method, i tried with :

desktop.auth.backend.AllowFirstUserDjangoBackend

desktop.auth.backend.AllowAllBackend

Thank you for your time :-)

[#2]

Hi Louxou,

Please see the section of the documentation titled "Enabling Secure Impersonation" (here's the CDH5.0 version, check with your version: http://www.cloudera.com/documentation/cdh/5-0-x/CDH5-Security-Guide/cdh5sg_search_security.html).

In short, configuring hadoop.proxyuser as you've done does not give permissions for solr secure impersonation, there are separate configurations required.

[#3]

Hi,

I have the same problem. I did exactly what the documentation request (see below)

Any idea ?

Doc : 

https://www.cloudera.com/documentation/enterprise/5-5-x/topics/search_sentry_impersonation.html

and 

https://www.cloudera.com/documentation/enterprise/5-5-x/topics/search_deploy_hue_search.html