with kerberos enabled a mapreduce job "runs as" the user that submitted it.
does this mean the user that submitted the job needs to have linux accounts
on all machines on the cluster?

how does mapreduce do this (run jobs as the user)? do the tasktrackers use
secure impersonation to run-as the user?

thanks! koert

Yes, User submitting a job needs to have an account on all the nodes.

Sent from my iPhone

On Jun 7, 2012, at 6:20 AM, Koert Kuipers <[EMAIL PROTECTED]> wrote:

> with kerberos enabled a mapreduce job "runs as" the user that submitted it.
> does this mean the user that submitted the job needs to have linux accounts
> on all machines on the cluster?
>
> how does mapreduce do this (run jobs as the user)? do the tasktrackers use
> secure impersonation to run-as the user?
>
> thanks! koert

thanks for your answer.

so at a large place like say yahoo, or facebook, assuming they use
kerberos, every analyst that uses hive has an account on every node of
their large cluster? sounds like an admin nightmare to me

On Thu, Jun 7, 2012 at 10:46 AM, Mapred Learn <[EMAIL PROTECTED]>wrote:

> Yes, User submitting a job needs to have an account on all the nodes.
>
> Sent from my iPhone
>
> On Jun 7, 2012, at 6:20 AM, Koert Kuipers <[EMAIL PROTECTED]> wrote:
>
> > with kerberos enabled a mapreduce job "runs as" the user that submitted
> it.
> > does this mean the user that submitted the job needs to have linux
> accounts
> > on all machines on the cluster?
> >
> > how does mapreduce do this (run jobs as the user)? do the tasktrackers
> use
> > secure impersonation to run-as the user?
> >
> > thanks! koert
>

Hi,
take a look at this :
http://hadoop.apache.org/common/docs/r1.0.3/Secure_Impersonation.html

I think that it can help you.

Slim Tebourbi.

2012/6/7 Koert Kuipers <[EMAIL PROTECTED]>

> thanks for your answer.
>
> so at a large place like say yahoo, or facebook, assuming they use
> kerberos, every analyst that uses hive has an account on every node of
> their large cluster? sounds like an admin nightmare to me
>
> On Thu, Jun 7, 2012 at 10:46 AM, Mapred Learn <[EMAIL PROTECTED]
> >wrote:
>
> > Yes, User submitting a job needs to have an account on all the nodes.
> >
> > Sent from my iPhone
> >
> > On Jun 7, 2012, at 6:20 AM, Koert Kuipers <[EMAIL PROTECTED]> wrote:
> >
> > > with kerberos enabled a mapreduce job "runs as" the user that submitted
> > it.
> > > does this mean the user that submitted the job needs to have linux
> > accounts
> > > on all machines on the cluster?
> > >
> > > how does mapreduce do this (run jobs as the user)? do the tasktrackers
> > use
> > > secure impersonation to run-as the user?
> > >
> > > thanks! koert
> >
>

If you provision your user/group information via LDAP to all your nodes it
is not a nightmare.

On Thu, Jun 7, 2012 at 7:49 AM, Koert Kuipers <[EMAIL PROTECTED]> wrote:

> thanks for your answer.
>
> so at a large place like say yahoo, or facebook, assuming they use
> kerberos, every analyst that uses hive has an account on every node of
> their large cluster? sounds like an admin nightmare to me
>
> On Thu, Jun 7, 2012 at 10:46 AM, Mapred Learn <[EMAIL PROTECTED]
> >wrote:
>
> > Yes, User submitting a job needs to have an account on all the nodes.
> >
> > Sent from my iPhone
> >
> > On Jun 7, 2012, at 6:20 AM, Koert Kuipers <[EMAIL PROTECTED]> wrote:
> >
> > > with kerberos enabled a mapreduce job "runs as" the user that submitted
> > it.
> > > does this mean the user that submitted the job needs to have linux
> > accounts
> > > on all machines on the cluster?
> > >
> > > how does mapreduce do this (run jobs as the user)? do the tasktrackers
> > use
> > > secure impersonation to run-as the user?
> > >
> > > thanks! koert
> >
>

--
Alejandro