All Products
Search

This Product

    E-MapReduce:Access component web UIs from the console

    Document Center

    E-MapReduce:Access component web UIs from the console

    Last Updated:Sep 16, 2026

    The Access Links and Ports feature in the E-MapReduce console is a convenient way to access the web UIs of open source components in your cluster. This topic describes how to configure security group rules and use access links to view these UIs.

    Note

    To learn about the different ways you can access component web UIs, see Access web UIs of open source components.

    Prerequisites

    You have created an E-MapReduce cluster. For more information, see Create a cluster.

    Access links and ports

    On the Access Links and Ports tab, you can view your services and their access addresses.

    1. Log on to the E-MapReduce console.

    2. In the top navigation bar, select a region and resource group as needed.

    3. Click the Cluster ID of your target cluster to open its details page.

    4. Click the Access Links and Ports tab to view the UI addresses for your component services.

    Internal access with a native UI address

    You can directly access the web UI of a service by using its native UI address. This method requires you to open the corresponding port for the service UI and add a rule to the security group. This method is straightforward, but its disadvantage is that you must open a port and grant access permissions for each service individually.

    1. Open the access port

    Important

    Make sure that your client machine and the E-MapReduce cluster nodes are in the same internal network.

    Add a rule to the security group of the E-MapReduce cluster to allow access from your client's IP address on the service's port.

    1. On the cluster details page, click the Basic Information tab.

    2. Click the link next to Security > Cluster Security Group to go to the security group settings for ECS.

    3. On the Security Group Details page, go to the Inbound rules, click Add Rule, and configure the following parameters.

      Parameter

      Description

      Example

      Port range

      The port of the service you want to access.

      For example, for the YARN web UI, enter 8088/8088. For more component ports, see Access web UIs of open source components.

      Authorization object

      The internal IP address of your client machine.

      Your internal IP address. It must be in the same internal network as the E-MapReduce cluster nodes.
      Note

      For more information about the parameters, see Security group rules.

    2. Access the native UI address

    1. On the cluster details page, click the Access Links and Ports tab and copy the Native UI Address for the desired service.

    2. On your client machine, open a browser and paste the address you copied. If you are using Linux, you can run the command curl -L http://<IP_address>:<service_port>/ to verify connectivity.

    Access using a Knox proxy address

    Alternatively, you can access the web UIs for all services through the Knox proxy address. This requires you to open port 8443 for Knox and authenticate by using a user that you added in Users. The advantage of this method is that it exposes fewer ports and provides identity authentication, but the disadvantage is that it involves more steps.

    Note

    This method is currently supported for the following services: YARN, HDFS, Spark 2, Spark 3, Flink, HBase, Impala, Trino, Presto, Tez, and Ranger.

    1. Add the Knox service

    If the Knox service is not already installed on your E-MapReduce cluster, add it.

    1. On the cluster details page, click the Services tab to go to the cluster service list.

    2. Click Add Service, select the Knox and OpenLDAP services, and complete the process.

    3. After a moment, the new services will appear in the service list. On the Access Links and Ports tab, the internal Knox proxy address will be displayed.

    2. (Optional) Associate an EIP

    Note

    If you only need to access web UIs using the internal Knox proxy address, or if an EIP is already associated, you can skip this step.

    1. On the cluster details page, click the Nodes tab to go to the node list.

    2. In the row for the emr-master node group, click the image icon, then find and click the node ID link for master-1-1 to open the ECS console.

    3. On the ECS Instance Details page, in the Configuration Information section under Public IP Address, Associate EIP with the ECS instance. For more information, see Elastic IP Addresses.

    4. Return to the E-MapReduce cluster details page. In the upper-right corner, click All operations > Synchronize Host Information to sync the host information.

    5. After a moment, the public Knox proxy address will appear on the Access Links and Ports tab.

    3. Open port 8443

    Add a rule to the cluster security group to open port 8443. The steps are similar to those in Open the access port. Key parameters are as follows:

    Parameter

    Description

    Example

    Port range

    The Knox port.

    Enter 8443/8443.

    Authorization object

    The IP address of your client machine.

    • To access from the internet, enter your public IP address.

    • To access from the internal network, enter your internal IP address.

      Important

      Make sure your internal IP address is in the same internal network as the E-MapReduce cluster nodes.

    4. Add a user

    Authentication requires the username and password of a user account created on the Users tab. If you have not yet added a user account, see OpenLDAP user management.

    5. Access the proxy address

    On the cluster details page, go to the Access Links and Ports tab.

    • Public access: Click the Public Address for the desired component. Enter your username and password to access the service's web UI.

    • Internal access: Click the Internal Address for the desired component. Enter your username and password to access the service's web UI. If you are using Linux, you can run the curl -k -u <username>:<password> https://<internal_ip>:8443/gateway/cluster-topo/xx command to verify connectivity.

    Special components

    Access the Ranger UI

    When Ranger is enabled for the cluster, you can use the default username and password to access the Ranger UI. For more information, see Ranger.

    • For DataLake clusters

      • For EMR-3.44.0 and later or EMR-5.10.0 and later:

        The default username is admin, and the default password is Admin1234.

      • For versions earlier than EMR-3.44.0 or EMR-5.10.0:

        The default username is admin, and the default password is admin1234.

    • For Hadoop clusters

      The default username and password are both admin.

    Access the Flink UI (for versions earlier than E-MapReduce 3.29.0)

    For earlier versions of the Flink component, you can only access the web UI by using an SSH tunnel. For more information, see Access web UIs of open source components by using an SSH tunnel.

    FAQ

    Why is the Access Links and Ports page blank?

    This page may be blank if your account has overdue payments, which can cause service suspension. To restore the service, settle all outstanding payments.

    Why am I unable to access the native UI address?

    Make sure that your client machine and the E-MapReduce cluster nodes are in the same internal network.

    Which username and password should I use?

    Use the credentials from a user account created on the User Management tab. For instructions, see OpenLDAP user management.

    Why does the login prompt keep appearing?

    1. On the cluster details page, click the Services tab and stop the OpenLDAP service.

    2. Log on to the master-1-1 node.

    3. Copy the repair_ldap_service.sh repair script to the master-1-1 node.

    4. As the root user, run the bash repair_ldap_service.sh command.

    5. Return to the E-MapReduce console. On the service details page for OpenLDAP, click More > Restart in the upper-right corner to restart the OpenLDAP service.

    Why does Knox proxy access fail?

    1. Make sure you have opened port 8443 as instructed.

    2. Access to the web UI may fail due to compatibility issues between Knox and earlier versions of some open source components. If this occurs, use a different access method. These compatibility issues affect the following service versions:

      • The HBase component in E-MapReduce versions 5.10.x to 5.12.x.

      • The Presto and Trino components in E-MapReduce versions 5.10.x to 5.14.x.

    Related documentation