apache/hadoop · error · AuthorizationException

Unauthorized connection for super-user: {} from IP {}

Error message

Unauthorized connection for super-user: {} from IP {}

What it means

DefaultImpersonationProvider throws AuthorizationException when the proxy-user ACL check passed but the client IP is not accepted: the MachineList from hadoop.proxyuser.<name>.hosts is null (property missing) or does not include remoteAddress. This is the host-level half of proxyuser authorization, evaluated after the group/user ACL.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/DefaultImpersonationProvider.java:132

    }

    UserGroupInformation realUser = user.getRealUser();
    if (realUser == null) {
      return;
    }
    
    AccessControlList acl = proxyUserAcl.get(configPrefix +
        realUser.getShortUserName());
    if (acl == null || !acl.isUserAllowed(user)) {
      throw new AuthorizationException("User: " + realUser.getUserName()
          + " is not allowed to impersonate " + user.getUserName());
    }

    MachineList MachineList = proxyHosts.get(
        getProxySuperuserIpConfKey(realUser.getShortUserName()));

    if(MachineList == null || !MachineList.includes(remoteAddress)) {
      throw new AuthorizationException("Unauthorized connection for super-user: "
          + realUser.getUserName() + " from IP " + remoteAddress);
    }
  }
  
  private String getAclKey(String key) {
    int endIndex = key.lastIndexOf(".");
    if (endIndex != -1) {
      return key.substring(0, endIndex); 
    }
    return key;
  }
  
  /**
   * Returns configuration key for effective usergroups allowed for a superuser
   * 
   * @param userName name of the superuser
   * @return configuration key for superuser usergroups
   */

View on GitHub (pinned to 2add963021)

Solutions

  1. Add or widen hadoop.proxyuser.<USER>.hosts in core-site.xml to include the connecting host's IP or FQDN (or "*" for testing)
  2. Refresh the proxy config on the NameNode/ResourceManager (`-refreshSuperUserGroupsConfiguration`) after the change
  3. Confirm the actual source IP of the denied connection from the message and add that exact address
  4. Check that the key uses the real user's short name: hadoop.proxyuser.<shortname>.hosts

Example fix

<!-- before -->
<property>
  <name>hadoop.proxyuser.oozie.groups</name>
  <value>*</value>
</property>
<!-- .hosts missing -> every impersonated call fails -->

<!-- after -->
<property>
  <name>hadoop.proxyuser.oozie.groups</name>
  <value>*</value>
</property>
<property>
  <name>hadoop.proxyuser.oozie.hosts</name>
  <value>10.0.0.5,10.0.0.6</value>
</property>
Defensive patterns

Strategy: try-catch

Validate before calling

String hostsKey = "hadoop.proxyuser." + realUser.getShortUserName() + ".hosts";
String hosts = conf.get(hostsKey);
if (hosts == null) {
  LOG.warn("{} not set; all proxy connections from this super-user will be denied", hostsKey);
}

Try / catch

try {
  ProxyUsers.authorize(proxyUgi, remoteAddress);
} catch (AuthorizationException e) {
  if (e.getMessage().contains("Unauthorized connection for super-user")) {
    // host ACL problem: fix hadoop.proxyuser.<user>.hosts, no point retrying from same IP
  }
  throw e;
}

Prevention

When it happens

Trigger: proxyUserAcl allowed the user, but proxyHosts.get("hadoop.proxyuser." + realUser.getShortUserName() + ".hosts") is null or MachineList.includes(remoteAddress) is false — e.g. the .hosts property lists specific IPs and the connection arrives from a different one (NAT, extra NIC, container network).

Common situations: Setting hadoop.proxyuser.<name>.groups but forgetting .hosts; Oozie or HiveServer2 on a host not listed; Kubernetes/Docker deployments where egress IP differs from the configured hostname; DNS entries that resolve differently from the connecting IP.

Understand the failure class

Related errors

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/c89f30449ec50f58. Report an issue: GitHub.