Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Superuser privilege for new HDFS Admin doesn't work

Solved Go to solution
Highlighted

Superuser privilege for new HDFS Admin doesn't work

Expert Contributor

Followed instructions here http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.0/bk_security/content/hdfs-encr-appendix.html to create a new hdfs admin for the purpose of making TDE zones creation work.

[opt1@tsys1 ~]$ groups
domain_users operator[opt1@tsys1 ~]$ hdfs dfsadmin -reportat org.apache.hadoop.util.ToolRunner.run(ToolRunner.java:90)
at org.apache.hadoop.hdfs.tools.DFSAdmin.main(DFSAdmin.java:2107)
report: Access denied for user opt1. Superuser privilege is required

Property values in Ambari shown below:

dfs.permissions.superusergroup=hdfs,operator

dfs.cluster.administrators=hdfs,opt1

hadoop.kms.blacklist.DECRYPT_EEK=opt1

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Superuser privilege for new HDFS Admin doesn't work

The change I am suggesting is dfs.permissions.superusergroup=operator

5 REPLIES 5

Re: Superuser privilege for new HDFS Admin doesn't work

I believe dfs.permissions.superusergroup can only contain a single value. If you change dfs.permissions.superusergroup to just 'operator' is the behavior as expected?

User hdfs will have still normal superuser access with this configuration change, since it starts the NameNode process.

Re: Superuser privilege for new HDFS Admin doesn't work

Expert Contributor

tried removing hdfs and just left opt1 in the administrator property but still getting the same issue.

Re: Superuser privilege for new HDFS Admin doesn't work

The change I am suggesting is dfs.permissions.superusergroup=operator

Re: Superuser privilege for new HDFS Admin doesn't work

Expert Contributor

removed hdfs in the superusergroup as well and just left operator, and it worked.

Re: Superuser privilege for new HDFS Admin doesn't work

Expert Contributor

This information (as many others) is wrong in the official HDP Security course from Hortonworks. In the HDFS Encryption presentations of the course it states that to create an HDFS admin user to manage EZ is enough with setting the following

(copy/paste here):

dfs.cluster.administrators=hdfs,encrypter
hadoop.kms.blacklist.DECRYPT_EEK=hdfs,encrypter