Support Questions

Find answers, ask questions, and share your expertise
Check out our newest addition to the community, the Cloudera Data Analytics (CDA) group hub.

User scf doesn't have permission to call 'getServiceState'

Hi, When I tried to execute a job by oozie I got this error

Main class [org.apache.oozie.action.hadoop.ShellMain], exit code [1]

After take a look to the yarn log I got this permission problem

2017-02-09 13:14:40,746 WARN  resourcemanager.RMAuditLogger ( - USER=scf	IP=x.x.x.x	OPERATION=getServiceState	TARGET=AdminService	RESULT=FAILURE	DESCRIPTION=Unauthorized user	PERMISSIONS=
2017-02-09 13:14:40,747 INFO  ipc.Server ( - IPC Server handler 0 on 8033, call org.apache.hadoop.ha.HAServiceProtocol.getServiceStatus from x.x.x.x:37178 Call#0 Retry#0 User pns doesn't have permission to call 'getServiceState'
	at org.apache.hadoop.yarn.server.resourcemanager.RMServerUtils.verifyAdminAccess(
	at org.apache.hadoop.yarn.server.resourcemanager.RMServerUtils.verifyAdminAccess(
	at org.apache.hadoop.yarn.server.resourcemanager.AdminService.checkAccess(
	at org.apache.hadoop.yarn.server.resourcemanager.AdminService.getServiceStatus(
	at org.apache.hadoop.ha.protocolPB.HAServiceProtocolServerSideTranslatorPB.getServiceStatus(
	at org.apache.hadoop.ha.proto.HAServiceProtocolProtos$HAServiceProtocolService$2.callBlockingMethod(
	at org.apache.hadoop.ipc.ProtobufRpcEngine$Server$
	at org.apache.hadoop.ipc.RPC$
	at org.apache.hadoop.ipc.Server$Handler$
	at org.apache.hadoop.ipc.Server$Handler$
	at Method)
	at org.apache.hadoop.ipc.Server$

Can anyone be so nice to tell me how to fix the permission for the user scf ? I


Expert Contributor

@Jean Rivera are you trying to access YARN RM service state from your script with user scf? if yes then it won't work as this action needs a YARN user (yarn by default) priviliges, i.e. you need to have same privilege as yarn user.

Is there a specific reason that you are getting the service state?



@Venkata Sudheer Kumar M

Hi, acctually no, this is the log of my resource manager. I run a job by oozie

Expert Contributor

@jean rivera from the job you are running through Oozie is trying to get the YARN RM HA/ NN HA status?

@Venkata Sudheer Kumar M

it seems so, yes

Expert Contributor

@jean rivera then you need to get rid of that to run as scf user, we don't have to get the status.

Take a Tour of the Community
Don't have an account?
Your experience may be limited. Sign in to explore more.