Understanding Hue users and groups
There are two types of users in Hue - superusers and general users referred to as users, each with specific privileges. These users can be a part of certain groups. Groups enable you to control which Hue applications and features your users can view and access when they log into Hue.
- Add and delete users
- Add and delete groups
- Assign permissions to groups
- Change a user into a superuser
- Import users and groups from an LDAP server
If a user is part of the superuser LDAP group in Hue, then that user is also a part of the group of superusers in Hue.
Users can only change their name, e-mail address, and password. They can log in to Hue and run Hue applications, subject to the permissions provided by the Hue groups to which they belong. This is different from how CDP perceives the Hue application when you submit a Hive or an Impala query from the Hue user interface (UI). Hue is a server between the users and the CDP services. Hue is considered as a single ‘hue’ user by the other services in the CDP cluster.
Hue is a gateway to CDP cluster services and both have separate permissions. A Hue superuser is not granted access to HDFS, Hive, and other CDP cluster services. Apache Ranger governs access to the CDP cluster services.
Hue user permissions are at the application level only. For example, a Hue superuser can filter Hue user access to a CDP service but cannot authorize the use of its features. Users who log on to the Hue UI must have permission to use Hue and to each CDP service accessible within Hue.