Perhaps there are ACLs set on WebHCat and Oozie? BTW - we could have a separate LDIF file for testing with sandbox and provide another import step. I also like the idea of a SandboxAuthenticationProvider that authenticates to their user store directly instead of LDAP. Then you would just need to use the sandbox topology instead of sample and have that provider configured.
On Thu, Sep 5, 2013 at 7:41 AM, Kevin Minder <[email protected]>wrote: > Hey Dilli, > > Again I totally agree that using a real user (e.g. bob) in the samples > would be better than relying on a system user (e.g. hue) would be better. > However for the samples we need to strike a balance between correctness > and ease of use. Ideally I'd rather not have users have to do the extra > steps you suggest below to follow the samples. > > At any rate there doesn't appear to be a home directory for the user use > in the Sandbox VM. Since the samples work using hue as the user a having a > home directory doesn't appear to be required. > > Kevin. > > > On 9/5/13 1:38 AM, Dilli Arumugam wrote: > >> Hi Kevin, >> >> Let me try testing with new sandbox. >> Meanwhile, I guess the error could be due to the fact that there is no >> hdfs home directory for "bob". >> >> I had to create it during my tests with secure cluster. >> Not sure whether I hit the problem with simple cluster. >> My bad that I did not document it or bring it to the attention of the >> group. >> >> The steps to create hdfs home directory for bob in a non secure hadoop. >> >> su hdfs >> hadoop fs -mkdir /user/bob >> hadoop fs -chown bob /user/bob >> >> Using "bob" or something that sounds like an end user name than "hue" >> would be preferrable. >> Knox samples should illustrate Knox handling calls from endusers than >> user hue or user hdfs >> >> Thanks. >> Dilli >> >> >> >> >> >> >> >> >> >> >> >> On Wed, Sep 4, 2013 at 9:30 PM, Kevin Minder < >> [email protected] >> <mailto:kevin.minder@**hortonworks.com<[email protected]>>> >> wrote: >> >> Dilli, >> As part of your fix for KNOX-76 you changed all of the samples to >> use not use Hadoop service identities. This is a good thing. >> However I'm not sure that using a totally fictitious user (i.e. >> bob) is really going to work either. The way that Sandbox (our >> primary test/sample vehicle) is currently setup both WebHCat and >> Oozie job submissions fail when the user bob is used. Note that >> WebHDFS operations work fine when user "bob" is used. Just to get >> everything working again I've changed all of the samples to use >> the user "hue". This works well for examples/testing against >> Sandbox but isn't very general. I would like your thoughts on >> this. Should we look into asking for a change in Sandbox to make >> things more open or do you have some other suggestion? The >> related jiras are: KNOX-108 and KNOX-109. You can look at the >> patch attached to KNOX-108 to see what I did. >> Kevin. >> >> >> > > -- > CONFIDENTIALITY NOTICE > NOTICE: This message is intended for the use of the individual or entity > to which it is addressed and may contain information that is confidential, > privileged and exempt from disclosure under applicable law. If the reader > of this message is not the intended recipient, you are hereby notified that > any printing, copying, dissemination, distribution, disclosure or > forwarding of this communication is strictly prohibited. If you have > received this communication in error, please contact the sender immediately > and delete it from your system. Thank You. >
