Superuser privilege for new HDFS Admin doesn't work

[#1]

Followed instructions here http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.0/bk_security/content/hdfs-encr-appendix.html to create a new hdfs admin for the purpose of making TDE zones creation work.

[opt1@tsys1 ~]$ groups
domain_users operator[opt1@tsys1 ~]$ hdfs dfsadmin -reportat org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:90)
at org.apache.hadoop.hdfs.tools.DFSAdmin.main(DFSAdmin.java:2107)
report: Access denied for user opt1. Superuser privilege is required

Property values in Ambari shown below:

dfs.permissions.superusergroup=hdfs,operator

dfs.cluster.administrators=hdfs,opt1

hadoop.kms.blacklist.DECRYPT_EEK=opt1

[#2]

I believe dfs.permissions.superusergroup can only contain a single value. If you change dfs.permissions.superusergroup to just 'operator' is the behavior as expected?

User hdfs will have still normal superuser access with this configuration change, since it starts the NameNode process.

[#3]

tried removing hdfs and just left opt1 in the administrator property but still getting the same issue.

[#4 · Accepted solution]

The change I am suggesting is dfs.permissions.superusergroup=operator

[#5]

removed hdfs in the superusergroup as well and just left operator, and it worked.

[#6]

This information (as many others) is wrong in the official HDP Security course from Hortonworks. In the HDFS Encryption presentations of the course it states that to create an HDFS admin user to manage EZ is enough with setting the following

(copy/paste here):

dfs.cluster.administrators=hdfs,encrypter
hadoop.kms.blacklist.DECRYPT_EEK=hdfs,encrypter