How Impersonation Works

Describes requirements for and limitations on impersonation.

When the mapr superuser attempts to impersonate another user to the MapR-FS or MapR-DB systems:

  1. The MapR client looks for that user name in the local operating system registry.
  2. If the user name is found, MapR sends the user’s UID and GID to the server for impersonation.

    If the user name is not found in the local operating system registry, the user action is not processed.

Limitations on Impersonation

Impersonation does not work in MapR when you are accessing:

  • MapR-FS or MapR-DB through a MapR client running on Windows.
  • MapR-FS or MapR-DB, if you attempt to have any user other than the MapR superuser impersonate another user.

Core Requirements for Impersonation

Only the mapr superuser is allowed to access to the MapR-FS and MapR-DB systems. Three conditions must be met in order for the mapr superuser to be able to impersonate another MapR user:

  1. The hadoop.proxyuser.mapr.groups and hadoop.proxyuser.mapr.hosts parameters must be set correctly in the core-site.xml file.

    See Enabling Impersonation for the mapr Superuser.

    These settings are not always required. If the MapR client accesses an ecosystem component, such as JobTracker or HiveServer2, these settings may be required. These settings are never needed when the MapR client accesses MapR-FS or MapR-DB directly. Enabling impersonation here ensures that the correct settings are in place if they are needed.

  2. The name of the MapR user that you want the mapr superuser to be able to impersonate must appear in the local operating system registry where the MapR client is running.
  3. The UID and GUID of the user name under which the MapR client is running must match exactly the UID and GUID for that user name on the server.

Component Requirements for Impersonation

Some MapR ecosystem components have additional requirements to enable impersonation.

The following components must have settings that support impersonation in the configuration files indicated, on each node where the component resides:

Application Development Requirements

You can set up impersonation in an application programmatically.