Creating Job Queue ACLs

A job queue ACL controls who can submit jobs to a queue, kill jobs, or modify their priority. The default behavior is that any user can submit a job, and jobs can only be seen and killed by the administrator or the user that submitted those jobs.

To create a job queue ACL, specify the following parameters in the mapred-queue-acls.xml file:

Parameter What it does
mapred.queue.names queue1,queue2,... Names the queues to which jobs can be submitted.
mapred.acls.enabled=true Indicates that ACLs will be checked whenever a user or group submits a job, tries to kill a job, or tries to change its priority. This parameter is set to true by default when security features for your cluster are enabled.
mapred.queue.<queue-name>.acl-submit-job user1,user2,... group1,group2,... Identifies the users and groups that can submit jobs to the specified queue-name.
mapred.queue.<queue-name>.acl-administer-job user1,user2,... group1,group2,... Identifies the users and groups that can change the priority or kill jobs submitted to the specified queue-name. Note that the job owner can always kill his own job or change its priority.

For information on configuring queue properties, see Configuring Properties for Queues. You can also set job initialization parameters for a queue.