Hue User Permissions

You can connect to Hue CLI from any Hue server host and then fetch the list of superusers by using the following two methods:

• Using the Hue shell and Python code
• Runing a SQL query on the auth_user table

To reset the password, run the following command as a root user from a Hue server:

/opt/cloudera/parcels/CDH/lib/hue/build/env/bin/hue changepassword <USER-ID> --cm-managed

The Hue superuser can reset his own password or help other users to reset their password in case the old password is lost. To reset the password:

1. Sign in to the Hue server as the root user.
2. Locate the HUE_CONF_DIR as shown in the following example:

   $ cd /var/run/cloudera-scm-agent/process/
   $ ls -lrt | grep HUE | tail -2
   drwxr-x--x 6 hue hue 200 Jan 5 13:07 612-hue-HUE_SERVER
   drwxr-x--x 6 hue hue 200 Jan 8 15:54 616-hue-HUE_SERVER

3. Change directory to HUE_CONF_DIR as shown in the following example:

   $ cd 616-hue-HUE_SERVER

4. Set the environment variable HUE_CONF_DIR as shown in the following example:

   $ export HUE_CONF_DIR=$PWD
   $ echo $HUE_CONF_DIR
   /var/run/cloudera-scm-agent/process/616-hue-HUE_SERVER

5. To reset the password for an unknown superuser:
   1. Open the Hue shell by running the following command:

      /opt/cloudera/parcels/CDH/lib/hue/build/env/bin/hue shell

   2. Enter the following Python code as shown in the following codeblock:

      from django.contrib.auth.models import User
      print "%s" % User.objects.filter(is_superuser = True)

      The list of users is displayed for the superuser of interest. For example:

      [<User: cconner>, <User: tuser5>]

6. To reset the password for another user:
   1. Open the Hue shell by running the following command:

      /opt/cloudera/parcels/CDH/lib/hue/build/env/bin/hue shell

   2. Enter the following Python code as shown in the following codeblock:

      from django.contrib.auth.models import User
      user = User.objects.get(username='<username>')
      user.set_password('<password>')
      user.save()

      Replace the <username> and <password> with the actual username and password.

In a non-secure cluster, the first user to log on to Hue is designated a superuser. In a secure cluster with LDAP, there are three ways to assign superuser status:

1. With the AllowAllBackend temporarily enabled, assign superuser status and Synchronize One User.
2. With the LdapBackend enabled, run a Hue shell command to apply superuser status.
3. Enable multiple backends so that the first user to log on still works when integrated with LDAP.

For example, filebrowser.access:Launch this application(3):

• Hue application name = filebrowser
• Permissions = access (as in, execute)
• Action = Launch this application (the HDFS filebrowser).
• Process ID in Hue database (3).