{"record":{"id":"39068f42bead77f8","repo":"apache/hadoop","slug":"user-is-not-allowed-to-impersonate","errorCode":null,"errorMessage":"User: {} is not allowed to impersonate {}","messagePattern":"User: (.+?) is not allowed to impersonate (.+?)","errorType":"exception","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/DefaultImpersonationProvider.java","lineNumber":124,"sourceCode":"  }\n\n  @Override\n  public void authorize(UserGroupInformation user,\n      InetAddress remoteAddress) throws AuthorizationException {\n    \n    if (user == null) {\n      throw new IllegalArgumentException(\"user is null.\");\n    }\n\n    UserGroupInformation realUser = user.getRealUser();\n    if (realUser == null) {\n      return;\n    }\n    \n    AccessControlList acl = proxyUserAcl.get(configPrefix +\n        realUser.getShortUserName());\n    if (acl == null || !acl.isUserAllowed(user)) {\n      throw new AuthorizationException(\"User: \" + realUser.getUserName()\n          + \" is not allowed to impersonate \" + user.getUserName());\n    }\n\n    MachineList MachineList = proxyHosts.get(\n        getProxySuperuserIpConfKey(realUser.getShortUserName()));\n\n    if(MachineList == null || !MachineList.includes(remoteAddress)) {\n      throw new AuthorizationException(\"Unauthorized connection for super-user: \"\n          + realUser.getUserName() + \" from IP \" + remoteAddress);\n    }\n  }\n  \n  private String getAclKey(String key) {\n    int endIndex = key.lastIndexOf(\".\");\n    if (endIndex != -1) {\n      return key.substring(0, endIndex); \n    }\n    return key;","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/authorize/DefaultImpersonationProvider.java#L106-L142","documentation":"DefaultImpersonationProvider throws AuthorizationException when a proxied request's real (super) user has no matching proxy ACL, or the ACL does not allow the effective user. The lookup key is configPrefix (default \"hadoop.proxyuser.\") plus the real user's short name, e.g. hadoop.proxyuser.oozie — with .groups and .hosts entries normally set in core-site.xml.","triggerScenarios":"user.getRealUser() is non-null and proxyUserAcl.get(\"hadoop.proxyuser.\" + realUser.getShortUserName()) returns null or !acl.isUserAllowed(user): the daemon user (oozie, hive, yarn, mapred, HTTP) is impersonating an end user without a proxyuser ACL entry.","commonSituations":"Oozie/HiveServer2/JobHistoryServer/WebHDFS deployments after enabling impersonation; missing or misnamed hadoop.proxyuser.<name>.groups key; case mismatch between the daemon's short username and the config key; forgetting to refresh after editing core-site.xml.","solutions":["Add hadoop.proxyuser.<USER>.groups (e.g. \"*\") and hadoop.proxyuser.<USER>.hosts (e.g. \"*\") to core-site.xml for the real user's short name shown in the message","Distribute the config and refresh: `hdfs dfsadmin -refreshSuperUserGroupsConfiguration` and `yarn rmadmin -refreshSuperUserGroupsConfiguration`, or restart the services","Verify the exact short username (run `whoami` as the daemon user) matches the hadoop.proxyuser.<USER> key, including case","If a custom prefix was set via hadoop.proxyuser.#.prefix-style configuration, confirm the provider's configPrefix matches your keys"],"exampleFix":"<!-- before: core-site.xml has no proxyuser entry for oozie -->\n\n<!-- after -->\n<property>\n  <name>hadoop.proxyuser.oozie.groups</name>\n  <value>*</value>\n</property>\n<property>\n  <name>hadoop.proxyuser.oozie.hosts</name>\n  <value>*</value>\n</property>","handlingStrategy":"try-catch","validationCode":"String realShort = realUser.getShortUserName();\nboolean aclConfigured = conf.get(\"hadoop.proxyuser.\" + realShort + \".groups\") != null;\nif (!aclConfigured) {\n  LOG.warn(\"No hadoop.proxyuser.{}.groups ACL configured; impersonation will be denied\", realShort);\n}","typeGuard":null,"tryCatchPattern":"try {\n  ProxyUsers.authorize(proxyUgi, remoteAddress);\n} catch (AuthorizationException e) {\n  // surface a 403 to the client with the real user name; do not retry\n  throw new AccessDeniedException(e.getMessage());\n}","preventionTips":["Deploy hadoop.proxyuser.<daemon>.groups and .hosts together whenever a proxying service is added","Automate refreshSuperUserGroupsConfiguration after core-site.xml changes","Monitor for the 'is not allowed to impersonate' audit line to catch misconfigurations early"],"tags":["authorization","proxy-user","impersonation","security","hadoop","core-site"],"backgroundTag":"impersonation-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}