Impersonation is a key concept throughout the Hadoop ecosystem. Impersonation grants a user (also known as a SuperUser or ProxyUser) right to access Hadoop user is granted on behalf of other users. It's similar to the idea of 'sudo' within Linux. To enable it you set the 'proxyuser' setting based on the user the service is running as, the groups or users you want it to be able to act on behalf of, and the hosts it should be able to do that from. For example, for Ambari Views with:
Ambari running as the user 'root' (which is the default) Wanting to allow Ambari to act on behalf of users in the groups 'users', 'hive-users' (just an example as you may have similar groups in LDAP) Ambari hostname of 'ambarihost.domain.local' You would set this in 'HDFS -> core-site' from Ambari: hadoop.proxyuser.root.groups=users,hive-users
hadoop.proxyuser.root.hosts=ambarihost.domain.local More detail is available in the documentation:
Apache Hadoop: Proxy user - Superusers Acting On Behalf Of Other Users Apache Oozie: User ProxyUser Configuration Apache YARN: yarn-site
yarn.resourcemanager.webapp.proxyuser.USERNAME.groups yarn.resourcemanager.webapp.proxyuser.USERNAME.hosts
... View more
