Configuring HttpFS proxy users

HttpFS proxy user functionality enables you to perform operations on behalf of another user. In Cloudera Base on premises, configure this user impersonation through Cloudera Manager.

Sign in to Cloudera Manager.
In the left navigation, click Clusters.
Select the Ozone service.
Click Configuration.
Under Scope, click HttpFS Gateway.

In the search bar, type proxy user.

The following HttpFS proxy user settings for Data Explorer and Hive are displayed.

Table 1. HttpFS proxy user configurations
Property	Description	Allowed values
`httpfs.proxyuser.hue.hosts`	Specifies the hosts from which Data Explorer can perform impersonation operations.	Comma-separated hostnames, IP addresses, or IP address ranges in CIDR format. Use `*` to allow any host.
`httpfs.proxyuser.hue.groups`	Specifies the groups whose members Data Explorer can impersonate.	Comma-separated group names. Use `*` to allow any group.
`httpfs.proxyuser.hive.hosts`	Specifies the hosts from which Hive can perform impersonation operations.	Comma-separated hostnames, IP addresses, or IP address ranges in CIDR format. Use `*` to allow any host.
`httpfs.proxyuser.hive.groups`	Specifies the groups whose members Hive can impersonate.	Comma-separated group names. Use `*` to allow any group.

Configure both the hosts and groups properties for the service account that performs impersonation.
important
- For production environments, Cloudera recommends that you specify authorized hosts and groups instead of using *.
- Cloudera Manager generates httpfs-site.xml. Do not edit this file directly because Cloudera Manager replaces it when the role restarts.
Click Save Changes.
Restart the affected HttpFS Gateway role instances after you change these properties.

HttpFS proxy user is configured and the user can perform operations on behalf of another user.

The following error indicates that the target user is not allowed by the proxy user's group configuration:
```
User: user/host@REALM is not allowed to impersonate user01
```
To resolve this error:
1. Verify that the Kerberos principal maps to the expected short user name through hadoop.security.auth_to_local.
2. Verify that the corresponding httpfs.proxyuser.hue.groups or httpfs.proxyuser.hive.groups property includes a group to which the target user belongs.
The following error indicates that the request originated from a host that is not allowed:
```
Unauthorized connection for super-user: user/host@REALM from IP 192.0.2.10
```
Verify that the corresponding httpfs.proxyuser.hue.hosts or httpfs.proxyuser.hive.hosts property includes the source hostname, IP address, or IP address range.