Mailing-List: contact user-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hadoop.apache.org
Received-SPF: pass (nike.apache.org: domain of harsh@cloudera.com designates
 209.85.214.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CANx3uAi=q5Aij=Amznt2245kdYJsKNFQmXZW4E1pbubb5c8hxg@mail.gmail.com>
References: 
 <CANx3uAi=q5Aij=Amznt2245kdYJsKNFQmXZW4E1pbubb5c8hxg@mail.gmail.com>
From: Harsh J <harsh@cloudera.com>
Date: Tue, 9 Oct 2012 08:04:47 +0530
Message-ID: 
 <CAOcnVr1Ks8R5MbbO1pnkE=P=qU3W4AnG7OY0P2KjezUm9oDkRQ@mail.gmail.com>
Subject: Re: Secure hadoop and group permission on HDFS
To: user@hadoop.apache.org
Content-Type: text/plain; charset=ISO-8859-1

Koert,

If you use the org.apache.hadoop.security.ShellBasedUnixGroupsMapping
class (via hadoop.security.group.mapping), then yes the NameNode's
view of the local unix groups (and the primary group) of the user is
the final say on what groups the user belongs to. This can be relied
on - but note that HDFS uses BSD style semantics when it comes to
groups and when creating directories/files, the parent directory
groups are inherited automatically unless altered after creation.

On Tue, Oct 9, 2012 at 2:30 AM, Koert Kuipers <koert@tresata.com> wrote:
> With secure hadoop the user name is authenticated by the kerberos server.
> But what about the groups that the user is a member of? Are these simple the
> groups that the user is a member of on the namenode machine?
> Is it viable to manage access to files on HDFS using groups on a secure
> hadoop cluster?
>


-- 
Harsh J