Hi all,

I want to use oozie to submit different workflows from different users.
These users are able to submit hadoop jobs.
I am using hadoop 0.20.205 and oozie 3.1.3
I have a hadoop user as a oozie-user

I have set the following things :

conf/oozie-site.xml :

< property >
< name >oozie.services.ext< /name >
< value >org.apache.oozie.service.HadoopAccessorService
< /value >
< description >
To add/replace services defined in 'oozie.services' with custom
implementations.Class names must be separated by commas.
< /description >
< /property >

conf/core-site.xml
< property>
< name>hadoop.proxyuser.hadoop.hosts< /name>
< value>*< / value>
< /property>
< property>
< name>hadoop.proxyuser.hadoop.groups< /name>
< value>*< /value>
< /property>

When I am submitting jobs as a hadoop user, I am able to run it properly.
But when I am able to submit the same work flow  from a different user, who
can submit the simple MR jobs to my hadoop cluster, I am getting the
following error:

JA009: java.io.IOException: java.io.IOException: The username kumar
obtained from the conf doesn't match the username hadoop the user
authenticated as    at
org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3943)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:563)
at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1388)
at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1384)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:396)
at
org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1059)

at org.apache.hadoop.ipc.Server$Handler.run(Server.java:1382)

Caused by: java.io.IOException: The username kumar obtained from the conf
doesn't match the username hadoop the user authenticated as
at org.apache.hadoop.mapred.JobInProgress.<init>(JobInProgress.java:426)
at org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3941)
... 11 more

Praveenesh,

If I'm not mistaken 0.20.205 does not support wildcards for the proxyuser
(hosts/groups) settings. You have to use explicit hosts/groups.

Thxs.

Alejandro
PS: please follow up this thread in the [EMAIL PROTECTED]

On Mon, Apr 2, 2012 at 2:15 PM, praveenesh kumar <[EMAIL PROTECTED]>wrote:

> Hi all,
>
> I want to use oozie to submit different workflows from different users.
> These users are able to submit hadoop jobs.
> I am using hadoop 0.20.205 and oozie 3.1.3
> I have a hadoop user as a oozie-user
>
> I have set the following things :
>
> conf/oozie-site.xml :
>
> < property >
> < name >oozie.services.ext< /name >
> < value >org.apache.oozie.service.HadoopAccessorService
> < /value >
> < description >
> To add/replace services defined in 'oozie.services' with custom
> implementations.Class names must be separated by commas.
> < /description >
> < /property >
>
> conf/core-site.xml
> < property>
> < name>hadoop.proxyuser.hadoop.hosts< /name>
> < value>*< / value>
> < /property>
> < property>
> < name>hadoop.proxyuser.hadoop.groups< /name>
> < value>*< /value>
> < /property>
>
> When I am submitting jobs as a hadoop user, I am able to run it properly.
> But when I am able to submit the same work flow  from a different user, who
> can submit the simple MR jobs to my hadoop cluster, I am getting the
> following error:
>
> JA009: java.io.IOException: java.io.IOException: The username kumar
> obtained from the conf doesn't match the username hadoop the user
> authenticated as    at
> org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3943)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at
>
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
>
> at
>
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
>
> at java.lang.reflect.Method.invoke(Method.java:597)
> at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:563)
> at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1388)
> at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1384)
> at java.security.AccessController.doPrivileged(Native Method)
> at javax.security.auth.Subject.doAs(Subject.java:396)
> at
>
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1059)
>
> at org.apache.hadoop.ipc.Server$Handler.run(Server.java:1382)
>
> Caused by: java.io.IOException: The username kumar obtained from the conf
> doesn't match the username hadoop the user authenticated as
> at org.apache.hadoop.mapred.JobInProgress.<init>(JobInProgress.java:426)
> at org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3941)
> ... 11 more
>

How can I specify multiple users /groups for proxy user setting ?
Can I give comma separated values in these settings ?

Thanks,
Praveenesh

On Mon, Apr 2, 2012 at 5:52 PM, Alejandro Abdelnur <[EMAIL PROTECTED]>wrote:

> Praveenesh,
>
> If I'm not mistaken 0.20.205 does not support wildcards for the proxyuser
> (hosts/groups) settings. You have to use explicit hosts/groups.
>
> Thxs.
>
> Alejandro
> PS: please follow up this thread in the [EMAIL PROTECTED]
>
> On Mon, Apr 2, 2012 at 2:15 PM, praveenesh kumar <[EMAIL PROTECTED]
> >wrote:
>
> > Hi all,
> >
> > I want to use oozie to submit different workflows from different users.
> > These users are able to submit hadoop jobs.
> > I am using hadoop 0.20.205 and oozie 3.1.3
> > I have a hadoop user as a oozie-user
> >
> > I have set the following things :
> >
> > conf/oozie-site.xml :
> >
> > < property >
> > < name >oozie.services.ext< /name >
> > < value >org.apache.oozie.service.HadoopAccessorService
> > < /value >
> > < description >
> > To add/replace services defined in 'oozie.services' with custom
> > implementations.Class names must be separated by commas.
> > < /description >
> > < /property >
> >
> > conf/core-site.xml
> > < property>
> > < name>hadoop.proxyuser.hadoop.hosts< /name>
> > < value>*< / value>
> > < /property>
> > < property>
> > < name>hadoop.proxyuser.hadoop.groups< /name>
> > < value>*< /value>
> > < /property>
> >
> > When I am submitting jobs as a hadoop user, I am able to run it properly.
> > But when I am able to submit the same work flow  from a different user,
> who
> > can submit the simple MR jobs to my hadoop cluster, I am getting the
> > following error:
> >
> > JA009: java.io.IOException: java.io.IOException: The username kumar
> > obtained from the conf doesn't match the username hadoop the user
> > authenticated as    at
> > org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3943)
> > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> > at
> >
> >
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> >
> > at
> >
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> >
> > at java.lang.reflect.Method.invoke(Method.java:597)
> > at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:563)
> > at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1388)
> > at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1384)
> > at java.security.AccessController.doPrivileged(Native Method)
> > at javax.security.auth.Subject.doAs(Subject.java:396)
> > at
> >
> >
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1059)
> >
> > at org.apache.hadoop.ipc.Server$Handler.run(Server.java:1382)
> >
> > Caused by: java.io.IOException: The username kumar obtained from the conf
> > doesn't match the username hadoop the user authenticated as
> > at org.apache.hadoop.mapred.JobInProgress.<init>(JobInProgress.java:426)
> > at org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3941)
> > ... 11 more
> >
>

multiple value are comma separated. keep in mind that valid values for
proxyuser groups, as the property name states are GROUPS, not USERS.

thxs.

Alejandro

On Mon, Apr 2, 2012 at 2:27 PM, praveenesh kumar <[EMAIL PROTECTED]>wrote:

> How can I specify multiple users /groups for proxy user setting ?
> Can I give comma separated values in these settings ?
>
> Thanks,
> Praveenesh
>
> On Mon, Apr 2, 2012 at 5:52 PM, Alejandro Abdelnur <[EMAIL PROTECTED]
> >wrote:
>
> > Praveenesh,
> >
> > If I'm not mistaken 0.20.205 does not support wildcards for the proxyuser
> > (hosts/groups) settings. You have to use explicit hosts/groups.
> >
> > Thxs.
> >
> > Alejandro
> > PS: please follow up this thread in the [EMAIL PROTECTED]
> >
> > On Mon, Apr 2, 2012 at 2:15 PM, praveenesh kumar <[EMAIL PROTECTED]
> > >wrote:
> >
> > > Hi all,
> > >
> > > I want to use oozie to submit different workflows from different users.
> > > These users are able to submit hadoop jobs.
> > > I am using hadoop 0.20.205 and oozie 3.1.3
> > > I have a hadoop user as a oozie-user
> > >
> > > I have set the following things :
> > >
> > > conf/oozie-site.xml :
> > >
> > > < property >
> > > < name >oozie.services.ext< /name >
> > > < value >org.apache.oozie.service.HadoopAccessorService
> > > < /value >
> > > < description >
> > > To add/replace services defined in 'oozie.services' with custom
> > > implementations.Class names must be separated by commas.
> > > < /description >
> > > < /property >
> > >
> > > conf/core-site.xml
> > > < property>
> > > < name>hadoop.proxyuser.hadoop.hosts< /name>
> > > < value>*< / value>
> > > < /property>
> > > < property>
> > > < name>hadoop.proxyuser.hadoop.groups< /name>
> > > < value>*< /value>
> > > < /property>
> > >
> > > When I am submitting jobs as a hadoop user, I am able to run it
> properly.
> > > But when I am able to submit the same work flow  from a different user,
> > who
> > > can submit the simple MR jobs to my hadoop cluster, I am getting the
> > > following error:
> > >
> > > JA009: java.io.IOException: java.io.IOException: The username kumar
> > > obtained from the conf doesn't match the username hadoop the user
> > > authenticated as    at
> > > org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3943)
> > > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> > > at
> > >
> > >
> >
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> > >
> > > at
> > >
> > >
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> > >
> > > at java.lang.reflect.Method.invoke(Method.java:597)
> > > at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:563)
> > > at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1388)
> > > at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1384)
> > > at java.security.AccessController.doPrivileged(Native Method)
> > > at javax.security.auth.Subject.doAs(Subject.java:396)
> > > at
> > >
> > >
> >
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1059)
> > >
> > > at org.apache.hadoop.ipc.Server$Handler.run(Server.java:1382)
> > >
> > > Caused by: java.io.IOException: The username kumar obtained from the
> conf
> > > doesn't match the username hadoop the user authenticated as
> > > at
> org.apache.hadoop.mapred.JobInProgress.<init>(JobInProgress.java:426)
> > > at org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3941)
> > > ... 11 more
> > >
> >
>

Is this a problem of proxy setting ? because after specifying the group
name also, I am not able to run it. Its still giving me the same error.

Thanks,
Praveenesh

On Mon, Apr 2, 2012 at 6:05 PM, Alejandro Abdelnur <[EMAIL PROTECTED]>wrote:

> multiple value are comma separated. keep in mind that valid values for
> proxyuser groups, as the property name states are GROUPS, not USERS.
>
> thxs.
>
> Alejandro
>
> On Mon, Apr 2, 2012 at 2:27 PM, praveenesh kumar <[EMAIL PROTECTED]
> >wrote:
>
> > How can I specify multiple users /groups for proxy user setting ?
> > Can I give comma separated values in these settings ?
> >
> > Thanks,
> > Praveenesh
> >
> > On Mon, Apr 2, 2012 at 5:52 PM, Alejandro Abdelnur <[EMAIL PROTECTED]
> > >wrote:
> >
> > > Praveenesh,
> > >
> > > If I'm not mistaken 0.20.205 does not support wildcards for the
> proxyuser
> > > (hosts/groups) settings. You have to use explicit hosts/groups.
> > >
> > > Thxs.
> > >
> > > Alejandro
> > > PS: please follow up this thread in the
> [EMAIL PROTECTED]
> > >
> > > On Mon, Apr 2, 2012 at 2:15 PM, praveenesh kumar <[EMAIL PROTECTED]
> > > >wrote:
> > >
> > > > Hi all,
> > > >
> > > > I want to use oozie to submit different workflows from different
> users.
> > > > These users are able to submit hadoop jobs.
> > > > I am using hadoop 0.20.205 and oozie 3.1.3
> > > > I have a hadoop user as a oozie-user
> > > >
> > > > I have set the following things :
> > > >
> > > > conf/oozie-site.xml :
> > > >
> > > > < property >
> > > > < name >oozie.services.ext< /name >
> > > > < value >org.apache.oozie.service.HadoopAccessorService
> > > > < /value >
> > > > < description >
> > > > To add/replace services defined in 'oozie.services' with custom
> > > > implementations.Class names must be separated by commas.
> > > > < /description >
> > > > < /property >
> > > >
> > > > conf/core-site.xml
> > > > < property>
> > > > < name>hadoop.proxyuser.hadoop.hosts< /name>
> > > > < value>*< / value>
> > > > < /property>
> > > > < property>
> > > > < name>hadoop.proxyuser.hadoop.groups< /name>
> > > > < value>*< /value>
> > > > < /property>
> > > >
> > > > When I am submitting jobs as a hadoop user, I am able to run it
> > properly.
> > > > But when I am able to submit the same work flow  from a different
> user,
> > > who
> > > > can submit the simple MR jobs to my hadoop cluster, I am getting the
> > > > following error:
> > > >
> > > > JA009: java.io.IOException: java.io.IOException: The username kumar
> > > > obtained from the conf doesn't match the username hadoop the user
> > > > authenticated as    at
> > > > org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3943)
> > > > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> > > > at
> > > >
> > > >
> > >
> >
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> > > >
> > > > at
> > > >
> > > >
> > >
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> > > >
> > > > at java.lang.reflect.Method.invoke(Method.java:597)
> > > > at org.apache.hadoop.ipc.RPC$Server.call(RPC.java:563)
> > > > at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1388)
> > > > at org.apache.hadoop.ipc.Server$Handler$1.run(Server.java:1384)
> > > > at java.security.AccessController.doPrivileged(Native Method)
> > > > at javax.security.auth.Subject.doAs(Subject.java:396)
> > > > at
> > > >
> > > >
> > >
> >
> org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1059)
> > > >
> > > > at org.apache.hadoop.ipc.Server$Handler.run(Server.java:1382)
> > > >
> > > > Caused by: java.io.IOException: The username kumar obtained from the
> > conf
> > > > doesn't match the username hadoop the user authenticated as
> > > > at
> > org.apache.hadoop.mapred.JobInProgress.<init>(JobInProgress.java:426)
> > > > at
> org.apache.hadoop.mapred.JobTracker.submitJob(JobTracker.java:3941)
> > > > ... 11 more
> > > >
> > >
> >
>