Understanding Hue users and groups

There are two types of users in Hue - superusers and general users referred to as users, each with specific privileges. These users can be a part of certain groups. Groups enable you to control which Hue applications and features your users can view and access when they log into Hue.

On a non-secure CDP cluster, the first user logging into Hue after the initial installation becomes the first superuser. Superusers have the permissions to perform the following administrative functions:

Add and delete users
Add and delete groups
Assign permissions to groups
Change a user into a superuser
Import users and groups from an LDAP server

If a user is part of the superuser LDAP group in Hue, then that user is also a part of the group of superusers in Hue.

Users can only change their name, e-mail address, and password. They can log in to Hue and run Hue applications, subject to the permissions provided by the Hue groups to which they belong. This is different from how CDP perceives the Hue application when you submit a Hive or an Impala query from the Hue user interface (UI). Hue is a server between the users and the CDP services. Hue is considered as a single ‘hue’ user by the other services in the CDP cluster.

For example, when a user ‘bob’ submits a query from Hue, Hue also sends the username of this user to the corresponding service in CDP. The HIVE_ON_TEZ service in CDP considers ‘bob’ as the owner of the query and not ‘hue’. This is illustrated in the following graphic:

Hue is a gateway to CDP cluster services and both have separate permissions. A Hue superuser is not granted access to HDFS, Hive, and other CDP cluster services. Apache Ranger governs access to the CDP cluster services.

Hue user permissions are at the application level only. For example, a Hue superuser can filter Hue user access to a CDP service but cannot authorize the use of its features. Users who log on to the Hue UI must have permission to use Hue and to each CDP service accessible within Hue.