ECS 3.6.2 Data Access Guide

Hadoop superuser and supergroup

The superuser in a Hadoop environment is the user that starts the namenode, usually hdfs or hdfs@REALM.COM. In an ECS HDFS configuration, the superuser is the bucket owner. Therefore, if you want the Hadoop superuser to have superuser access to the ECS bucket, you should ensure that the bucket is owned by hdfs, or hdfs@REALM.COM, or hdfs@DOMAIN.COM if you are using Active Directory to authenticate users in the Hadoop environment.

To ensure that the Hadoop client has superuser access, you can also configure a superuser group using the dfs.permissions.superusergroup property in the core-site.xml file. In simple mode, the check to determine if a user is a member of the supergroup is made on the client by checking the value of the dfs.permissions.supergroup Hadoop property. In Kerberos mode, the check to determine if a user is a member of the supergroup is made on the ECS server.

In general, when buckets are configured for access by the Hadoop superuser or by a Hadoop superuser group, the superuser has full (read and write) access to the bucket. Users without superuser privileges normally have read access, but that depends on how the bucket was created. A user does not have to be an ECS object user to be granted access to the bucket. The name must match a Unix local, Kerberos, or AD user (depending on the authentication mode being used).

It is a best practice to ensure that the hdfs user or hdfs principal either be the bucket owner (superuser), or a member of a superuser group.