How Impersonation Works

Introduces impersonation functionality, limitations, and core requirements.

If a user attempts to impersonate another user to the file system or HPE Ezmeral Data Fabric Database systems and the configuration parameters for resolving the UID and GIDs on the server (see Resolving Username with UID and GIDs During Impersonation) are disabled:

  1. The Data Fabric client looks for that user name in the local operating system registry.
  2. If the user name is:
    • Found, Data Fabric sends the user’s UID and GID to the server for impersonation.
    • Not found in the local operating system registry, the user action is not processed.

If a user attempts to impersonate another user to the file system or HPE Ezmeral Data Fabric Database systems and if the configuration parameters for resolving the UID and GIDs on the server (see Resolving Username with UID and GIDs During Impersonation) are enabled:

  1. The Data Fabric client asks CLDB to look for that user name and resolve the UID and GIDs for that user on the server.
  2. If the user name is:
    • Found on the server, the server allows the user to proceed with the impersonation.
    • Not found, the user action is not processed.
    NOTE
    If the configuration property for resolving the username is set on the client, and the configuration property for resolving the username is not set on CLDB, the operation fails with an error.

Limitations on Impersonation

Service with impersonation tickets cannot be used to impersonate the mapr or root users. A scoped service with impersonation ticket cannot contain the UID of the root or mapr user (in the impersonated UIDs) and the GID of the root or mapr user (in the impersonated GIDs). The mapr user can impersonate any user, including root.

Core Requirements for Impersonation

The mapr superuser is allowed to access to the file system and HPE Ezmeral Data Fabric Database systems. The following conditions must be met for the mapr superuser to be able to impersonate another Data Fabric user:

  1. The hadoop.proxyuser.mapr.groups and hadoop.proxyuser.mapr.hosts parameters must be set correctly in the core-site.xml file.

    See Enabling Impersonation for the mapr Superuser.

    These settings are not always required. The hadoop proxy user functionality is only applicable to ecosystem components included in the Data Fabric distribution for Apache Hadoop. If the Data Fabric client accesses an ecosystem component, such as HiveServer2, these settings may be required. These settings are never needed if the Data Fabric client accesses the file system or HPE Ezmeral Data Fabric Database directly. Enabling impersonation here ensures that the correct settings are in place if they are needed.

  2. The name of the Data Fabric user that you want the mapr superuser to be able to impersonate must appear in the local operating system registry where the Data Fabric client is running if server-side resolution of UID and GIDs is not enabled.
  3. The UID and GUID of the user name under which the Data Fabric client is running must match exactly the UID and GUID for that user name on the server.
NOTE
The mapr user can impersonate any user, including user root.

For all other users with access to the file system and HPE Ezmeral Data Fabric Database systems, the following conditions must be met for the user to impersonate another user.

  1. A valid servicewithimpersonation ticket must be present for the user who intends to impersonate on the system.
  2. The name of the user to impersonate must appear in the local operating system registry where the Data Fabric client is running if the server-side resolution of UID and GIDs is not enabled.
  3. The UID and GUID of the user name under which the Data Fabric client is running must match exactly the UID and GUID for that user name on the server.
NOTE
If a user is not authorized to impersonate, then the operations proceeds as the user, not the target user. Some operations succeed and some do not, even if the user has all the permissions for these operations. Also, if a user with full access and impersonating capability tries to impersonate another user, the operations succeeds only if the target user has permissions on the directory.

Component Requirements for Impersonation

Some Data Fabric ecosystem components have additional requirements to enable impersonation.

The following components must have settings that support impersonation in the configuration files indicated, on each node where the component resides:

  • Drill: Edit the drill-env.sh file. See Configuring User Impersonation in the Apache Drill documentation.
  • HBase: Edit the hbase­site.xml file. See Impersonation through the HBase REST Gateway.
  • HiveServer2: Edit the hive-site.xml file. See Hive User Impersonation.
  • Hue: Edit the hue.ini file.
  • Spark: No special settings are required for Spark in MapReduce 2 (YARN) mode since Spark automatically inherits the correct behavior from YARN. If running standalone, Spark cannot perform impersonation and should not be used if security is important.

Application Development Requirements

You can set up impersonation in an application programmatically.