All Products
Search

This Product

    E-MapReduce:OpenLDAP user management

    Document Center

    E-MapReduce:OpenLDAP user management

    Last Updated:Jul 17, 2026

    This topic describes how to manage E-MapReduce (EMR) user accounts on the Users page of the EMR console.

    Background information

    EMR user information is stored in the cluster's built-in OpenLDAP service, primarily used for identity authentication within the cluster.

    EMR users provide identity authentication when you access component web UIs or enable LDAP authentication for components. If you set Ranger's user source to LDAP, you can control permissions for these users. On a high-security cluster, EMR users can also run the kinit command.

    EMR users are listed on the user management page. The RAM user permissions you use to log on to the EMR console determine the actions you can perform. RAM users fall into the following categories:

    • Administrator: An Alibaba Cloud account or a RAM user with the emr:ManageUserPlatform (granted by a policy such as AliyunEMRFullAccess) and emr:CreateLdapUser permissions. Administrators can view all users in the cluster, add or delete users, reset passwords, and modify user remarks.

    • Common user: A RAM user with other policies, such as the AliyunEMRDevelopAccess policy. Common users can only view the EMR user that shares their username. They can reset their own password and modify remarks, but cannot add or delete users.

    Prerequisites

    • You have created a cluster that includes the OpenLDAP service. For more information, see Create a cluster.

    • You have created a RAM user. For more information, see Create a RAM user.

      Note

      You must create a RAM user first. Only an EMR user account whose username is the same as the username of a RAM user can be added to the Users page of the EMR console.

    Add a user

    Important

    If you use a RAM user to log on to the EMR console, you must grant the ram:ListUsers permission to the RAM user before you add a user account. You can attach the AliyunRAMReadOnlyAccess policy to the RAM user in the RAM console by using your Alibaba Cloud account. You can also configure a custom policy to grant the ram:ListUsers permission to the RAM user.

    1. Go to the User Management page.

      1. Log on to the E-MapReduce console.

      2. In the top navigation bar, select a region and resource group based on your requirements.

      3. On the EMR on ECS page, click the name of the target cluster.

      4. Click the Users tab.

    2. On the Users page, click Add User.

    3. In the Add User dialog box, select an existing RAM user from the Username drop-down list, and then enter a password in the Password and Confirm Password fields.

    4. Click OK.

    Delete a user

    1. On the Users page, find the user to delete and click Delete in the Actions column.

    2. In the Delete User dialog box, click OK.

    Reset user password

    You can reset the password of a user account.

    Important

    This operation may cause tasks that are running to fail.

    1. On the Users page, find the user and click Reset Password in the Actions column.

    2. In the Reset User Password dialog box, enter the new password in the Password and Confirm Password fields.

    3. Click OK.

    Related documentation

    If you created a high-security cluster, see Basic Kerberos usage for Kerberos configurations and basic operations such as exporting a keytab file.