If clusterusers is a group then you should have a space separator between users and groups in acl config.    Something like    yarn.scheduler.capacity.root.default.acl_submit_applications=yarn,ambari-qa clusterusers ... View more

Check the config property hadoop.http.authentication.type, if this is set to kerberos , then accessing UIs would need kerberos credentials on client. By default this is et to kerberos in HDP 3.x version when cluster is kerberized.    If you want to disable kerberos auth then change below config properties.  ->  Ambari > HDFS> Configs> in core-site hadoop.http.authentication.type=simple hadoop.http.authentication.simple.anonymous.allowed=true ... View more