We are running HDP cluster version 3.1.5 with Ranger KMS configured. Ranger is configured to sync with AD for authentication.   I tried creating a local user, named apencruser, on Linux as it is recommended to use a dedicated superuser for encryption. But this user is not synced with Ranger as Ranger is configured to sync users from AD. So, the Ranger KMS permissions cannot be applied to the local user(apencruser).   Because of this, "hdfs crypto -createZone ..." command failed. But then, when we try to login as hdfs user, for which the RangerKMS permissions are defined properly, we still get error that apencruser doesn't have required permissions.   How can force hdfs command to use "hdfs" user instead of "apencruser". We even tried removing the newly created apencruser userid. But still the error is the same.   [hdfs@sigma-02 ~]$ hdfs crypto -createZone -keyName ap_prod_encr_key -path /warehouse/tablespace/managed/hive/sec.db RemoteException: User:apencruser not allowed to do 'GET_METADATA' on 'ap_prod_encr_key' ... View more