All Products
Search

This Product

    E-MapReduce:JindoFS permissions

    Document Center

    E-MapReduce:JindoFS permissions

    Last Updated:Jun 21, 2026

    JindoFS supports two file system permission models in block storage mode: Unix permission and Ranger permission.

    Background information

    In block storage mode, two types of file system permissions are supported:
    • Unix permissions: Files are assigned 777 permissions.
    • Ranger permissions: Supports advanced configurations such as path wildcard characters.
    User permissions are configured in Apache Ranger. Enabling the JindoFS plug-in allows you to centrally manage permissions for JindoFS and other components.JindoFS权限

    Enable Unix permission

    1. Go to the SmartData service.
      1. Log on to the EMR console.
      2. In the top navigation bar, select a region and a resource group as needed.
      3. Click the Clusters tab.
      4. On the Clusters page, find your cluster and click Details in the Actions column.
      5. In the navigation pane on the left, choose Services > SmartData.
    2. Go to the bigboot service configuration page.
      1. Click the Configure tab.
      2. Click bigboot .
    3. Click Custom Configuration. In the Add Configuration Item dialog box, set Keyjfs.namespaces.<namespace>.permission.method to and Valueunix to , and then click OK.
    4. Save the configuration.
      1. In the upper-right corner, click Save.
      2. In the Confirm dialog box, enter a reason for the change and enable Auto-update Configuration.
      3. Click OK.
    5. Restart the component.
      1. In the upper-right corner, from the Actions > Restart Jindo Namespace Service.
      2. Enter a reason for the restart and click OK.
      After you enable file system permissions, you can manage them in the same way as in HDFS. The following commands are supported. 
      hadoop fs -chmod 777 jfs://{namespace_name}/dir1/file1
hadoop fs -chown john:staff jfs://{namespace_name}/dir1/file1
      If a user lacks permission for a file, an error message similar to the following is returned. 
      [root@emr-header-1 ~]# hadoop fs -ls jfs://test/user/
ls: java.security.AccessControlException: Permission denied. Server Exception

    Enable Ranger permission

    1. Configure JindoFS to use Ranger.
      1. On the bigboot tab, click Custom Configuration.
      2. In the Add Configuration Item dialog box, set Keyjfs.namespaces.<namespace>.permission.method to and Valueranger to .
      3. Save the configuration.
        1. In the upper-right corner, click Save.
        2. In the Confirm dialog box, enter a reason and enable Auto-update Configuration.
        3. Click OK.
      4. Restart the component.
        1. In the upper-right corner, from the Actions > Restart Jindo Namespace Service.
        2. Enter a reason and click OK.
    2. Configure Ranger.
      1. Go to the Ranger UI.
        For more information, see Overview.
      2. Add an HDFS service in the Ranger UI.
        On the Service Manager page, click the + icon in the upper-right corner of the HDFS panel to create an HDFS service.
      3. Configure the following parameters.
        Parameter Description
        Service name The service name. Use the format jfs-{namespace_name}.
        Username A custom username.
        Password A custom password.
        Namenode URL jfs://{namespace_name} Enter .
        Authorization enabled Keep the default value, No.
        Authentication type Keep the default value, Simple.
        dfs.datanode.kerberos.principal Leave this blank.
        dfs.namenode.kerberos.principal
        dfs.secondary.namenode.kerberos.principal
        Add new configurations
      4. Click Add.

    Enable Ranger permission with LDAP user groups

    If you use Ranger UserSync to synchronize user group information from an LDAP server, you must also update the JindoFS configuration. This change enables JindoFS to retrieve user group information from LDAP and validate Ranger permissions against the user's group memberships.

    1. On the bigboot tab, click Custom Configuration.
    2. In the Add Configuration Item dialog box, add the following parameters to configure LDAP, and then click OK.
      Parameter Example
      hadoop.security.group.mapping org.apache.hadoop.security.CompositeGroupsMapping
      hadoop.security.group.mapping.providers shell4services,ad4users
      hadoop.security.group.mapping.providers.combined true
      hadoop.security.group.mapping.provider.shell4services org.apache.hadoop.security.ShellBasedUnixGroupsMapping
      hadoop.security.group.mapping.provider.ad4users org.apache.hadoop.security.LdapGroupsMapping
      hadoop.security.group.mapping.ldap.url ldap://emr-header-1:10389
      hadoop.security.group.mapping.ldap.search.filter.user (&(objectClass=person)(uid={0}))
      hadoop.security.group.mapping.ldap.search.filter.group (objectClass=groupOfNames)
      hadoop.security.group.mapping.ldap.base o=emr
      Note These configuration items must match their open source HDFS counterparts.
    3. Save the configuration.
      1. In the upper-right corner, click Save.
      2. In the Confirm dialog box, enter a reason and enable Auto-update Configuration.
      3. Click OK.
    4. Restart all related components.
      1. In the upper-right corner, from the Actions > Restart All Components.
      2. Enter a reason for the restart and click OK.
    5. Log on to the emr-header-1 node over SSH, configure Ranger UserSync, and enable the LDAP option.