This is the documentation for Cloudera Manager 5.1.x. Documentation for other versions is available at Cloudera Documentation.

Cloudera Manager User Accounts

Required Role:

Access to Cloudera Manager features is controlled by user accounts. A user account identifies how a user is authenticated and determines what privileges are granted to the user.

When you are logged in to the Cloudera Manager Admin Console, the username you are logged in as is at the far right of the top navigation bar—for example, if you are logged in as admin you will see .

An user in the Administrator role manages user accounts through the Administration > Users page.

User Authentication

Cloudera Manager provides several mechanisms for authenticating users. You can configure Cloudera Manager to authenticate users against the Cloudera Manager database or against an external authentication service. The external authentication service can be an LDAP server (Active Directory or an OpenLDAP compatible directory), or you can specify another external service. Cloudera Manager also supports using the Security Assertion Markup Language (SAML) to enable single sign-on.

If you are using LDAP or an external service you can configure Cloudera Manager so that it can use both methods of authentication (internal database and external service), and you can determine the order in which it performs these searches. If you select an external authentication mechanism, Administrator users can always authenticate against the Cloudera Manager database. This is to prevent locking everyone out if the authentication settings are misconfigured—such as with a bad LDAP URL.

With external authentication, you can restrict login access to members of specific groups, and can specify groups whose members are automatically given Administrator access to Cloudera Manager.

Users accounts in the Cloudera Manager database page show Cloudera Manager in the User Type column. User accounts in an LDAP directory or other external authentication mechanism show External in the User Type column.

User Roles

A user's role determines the Cloudera Manager features visible to the user and the actions the user can perform. All the tasks in the Cloudera Manager documentation indicate which role is required to perform the task.
  Note: Currently there is no indication in the Cloudera Manager Admin Console of the role a logged in user is assigned to. To determine your role, contact a user that has the Administrator role.
A user account can be assigned one of the following roles:
  • Read-Only - Allows the user to view service and monitoring information but cannot add services or take any actions that affect the state of the cluster.
  • Limited Operator - Allows the user to view service and monitoring information and decommission hosts (except hosts running Cloudera Management Service roles), but cannot add services or take any other actions that affect the state of the cluster.
  • Operator - Allows the user to view service and monitoring information, stop, start, and restart clusters, services, and roles (except the Cloudera Management Service and roles), decommission and recommission hosts (except hosts running Cloudera Management Service roles), and decommission and recommission roles (except Cloudera Management Service roles), but cannot add services, roles, or hosts, or take any other actions that affect the state of the cluster.
  • Configurator - Allows the user to perform all Operator operations, configure services (except the Cloudera Management Service), enter and exit maintenance mode, and manage dashboards (including Cloudera Management Service dashboards).
  • Administrator - Allows the user to add, change, delete, and configure services, roles, and hosts and administer user accounts. Even if you are using an external authentication mechanism for user authentication, users with Administrator privileges can log in to Cloudera Manager using their local Cloudera Manager username and password. (This prevents the system from locking everyone out if the external authentication settings get misconfigured.)
The full set of roles are available with Cloudera Enterprise; Cloudera Express supports only the Read-Only and Administrator roles.

Changing the Logged-In Internal User Password

  1. Right-click the logged-in username at the far right of the top navigation bar and select Change Password.
  2. Enter the current password, and a new password twice and then click Update.

Adding an Internal User Account

  1. Select Administration > Users.
  2. Click the Add User button.
  3. Enter a username and password.
  4. In the Role drop-down, select a role for the new user.
  5. Click Add.

Assigning User Roles

  1. Select Administration > Users.
  2. Check the checkbox next to one or more usernames.
  3. Select Actions for Selected > Assign User Roles.
  4. In the drop-down, select the role.
  5. Click the Assign Role button.

Changing an Internal User Account Password

  1. Select Administration > Users.
  2. Click the Change Password button next to a username with User Type Cloudera Manager.
  3. Type the new password and repeat it to confirm.
  4. Click the Update button to make the change.

Deleting Internal User Accounts

  1. Select Administration > Users.
  2. Check the checkbox next to one or more usernames with User Type Cloudera Manager.
  3. Select Actions for Selected > Delete.
  4. Click the OK button. (There is no confirmation of the action.)
Page generated September 3, 2015.