yes, still cannot impersonate. did you manage to configure Livy with impersonation on CDH?
בתאריך יום ה׳, 18 באפר׳ 2019 ב-9:48 מאת Prabhu Kasinathan < vasurampra...@gmail.com>: > Did you try restarting HDFS for updated core-site.xml to be effective? > > Thanks! > Prabhu > > > On Apr 17, 2019, at 11:30 PM, rei sivan <rsivan1...@gmail.com> wrote: > > > > ---------- Forwarded message --------- > > From: rei sivan <rsivan1...@gmail.com> > > Date: Wed, 17 Apr 2019, 21:06 > > Subject: livy impersonation in kerberized cluster > > To: <user-i...@livy.incubator.apache.org> > > > > > > I have a kerberized CDH 6 cluster with active directory. > > Livy is installed on an edge node with HDFS, YARN, and SPARK gateways. > > I've created keytabs for both Livy.server.auth\launch configuration > > properties and Livy work as expected. ( create the session with > > livy.server.launch principal) > > however, when I enable the impersonation I getting the following error > when > > I'm trying to create a session: > > "(org.apache.hadoop.security.authorize.AuthorizationException): user: > > livy_app@domain is not allowed to impersonate other-user" ... ERROR > > RSCClient:150 - Failed to connect to context. > > child process exited with code 1. > > at org.apache.livy.rsc.ContextLauncher$ChildProcess$1.run(394) > > at org.apache.livy.rsc.ContextLauncher$ChildProcess$2.run(445) > > , Although the livy_app user is set in core-site.xml as is should be and > > this change has been distributed to all the nodes in the cluster. > > > > <property> > > <name>hadoop.proxyuser.livy_app.groups</name> > > <value>*</value> > > </property> > > <property> > > <name>hadoop.proxyuser.livy_app.hosts</name> > > <value>*</value> > > </property> > > > > also, the home directory for livy_app exists in HDFS > > (i toke these instructions from > > > https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.6.0/bk_command-line-installation/content/ch19s06s04.html > > and > > > https://enterprise-docs.anaconda.com/en/latest/admin/advanced/config-livy-server.html > > ) > > looks like I'm getting token for livy_app(ugi=other-user (auth:PROXY) via > > livy_app@domain (auth:KERBEROS)) > > is anyone encounter this problem? > > > > > > Thanks, > -- Best Regards Rei Sivan TL:052-3668360
