Hi Jy,

Sentry only works on groups. You can always define a new group that just contains a single user to work around this. This is commonly (maybe always) defined for you already, so you might be able to just replace "user" with "group" and get that statement to do the logically equivalent thing.

Group management is configurable and is commonly either shell-based or LDAP-based. You can find it in HDFS configuration under the name "Hadoop User Group Mapping Implementation". If it is shell-based (the default), then you need to make it so your operating system recognizes the correct group membership for your users via standard OS user administration commands.

Thanks,
Darren