apache/hadoop · error · AuthorizationException

User: {} is not allowed to impersonate {}

Error message

User: {} is not allowed to impersonate {}

What it means

DefaultImpersonationProvider throws AuthorizationException when a proxied request's real (super) user has no matching proxy ACL, or the ACL does not allow the effective user. The lookup key is configPrefix (default "hadoop.proxyuser.") plus the real user's short name, e.g. hadoop.proxyuser.oozie — with .groups and .hosts entries normally set in core-site.xml.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/DefaultImpersonationProvider.java:124

  }

  @Override
  public void authorize(UserGroupInformation user,
      InetAddress remoteAddress) throws AuthorizationException {
    
    if (user == null) {
      throw new IllegalArgumentException("user is null.");
    }

    UserGroupInformation realUser = user.getRealUser();
    if (realUser == null) {
      return;
    }
    
    AccessControlList acl = proxyUserAcl.get(configPrefix +
        realUser.getShortUserName());
    if (acl == null || !acl.isUserAllowed(user)) {
      throw new AuthorizationException("User: " + realUser.getUserName()
          + " is not allowed to impersonate " + user.getUserName());
    }

    MachineList MachineList = proxyHosts.get(
        getProxySuperuserIpConfKey(realUser.getShortUserName()));

    if(MachineList == null || !MachineList.includes(remoteAddress)) {
      throw new AuthorizationException("Unauthorized connection for super-user: "
          + realUser.getUserName() + " from IP " + remoteAddress);
    }
  }
  
  private String getAclKey(String key) {
    int endIndex = key.lastIndexOf(".");
    if (endIndex != -1) {
      return key.substring(0, endIndex); 
    }
    return key;

View on GitHub (pinned to 2add963021)

Solutions

1. Add hadoop.proxyuser.<USER>.groups (e.g. "*") and hadoop.proxyuser.<USER>.hosts (e.g. "*") to core-site.xml for the real user's short name shown in the message
2. Distribute the config and refresh: `hdfs dfsadmin -refreshSuperUserGroupsConfiguration` and `yarn rmadmin -refreshSuperUserGroupsConfiguration`, or restart the services
3. Verify the exact short username (run `whoami` as the daemon user) matches the hadoop.proxyuser.<USER> key, including case
4. If a custom prefix was set via hadoop.proxyuser.#.prefix-style configuration, confirm the provider's configPrefix matches your keys

Example fix

<!-- before: core-site.xml has no proxyuser entry for oozie -->

<!-- after -->
<property>
  <name>hadoop.proxyuser.oozie.groups</name>
  <value>*</value>
</property>
<property>
  <name>hadoop.proxyuser.oozie.hosts</name>
  <value>*</value>
</property>

String realShort = realUser.getShortUserName();
boolean aclConfigured = conf.get("hadoop.proxyuser." + realShort + ".groups") != null;
if (!aclConfigured) {
  LOG.warn("No hadoop.proxyuser.{}.groups ACL configured; impersonation will be denied", realShort);
}

try {
  ProxyUsers.authorize(proxyUgi, remoteAddress);
} catch (AuthorizationException e) {
  // surface a 403 to the client with the real user name; do not retry
  throw new AccessDeniedException(e.getMessage());
}

When it happens

Trigger: user.getRealUser() is non-null and proxyUserAcl.get("hadoop.proxyuser." + realUser.getShortUserName()) returns null or !acl.isUserAllowed(user): the daemon user (oozie, hive, yarn, mapred, HTTP) is impersonating an end user without a proxyuser ACL entry.

Common situations: Oozie/HiveServer2/JobHistoryServer/WebHDFS deployments after enabling impersonation; missing or misnamed hadoop.proxyuser.<name>.groups key; case mismatch between the daemon's short username and the config key; forgetting to refresh after editing core-site.xml.

Related errors

• Unauthorized connection for super-user: {} from IP {}
• user is null.
• hadoop.security.authorizationis configured to true but servi
• FATAL_UNAUTHORIZED
• Null protocol not authorized

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/39068f42bead77f8. Report an issue: GitHub.