All Products
Search

This Product

    E-MapReduce:Manage JindoFS permissions

    Document Center

    E-MapReduce:Manage JindoFS permissions

    Last Updated:Jul 17, 2026

    Control access to JindoFS files using Unix-based permissions or Apache Ranger, depending on your namespace storage mode.

    Permission methods by storage mode

    Storage mode Unix permissions Ranger permissions
    Block storage mode Supported Supported
    Cache mode Not supported Supported (only option)

    Unix permissions (block storage mode only): Set rwxrwxrwx permissions on files and configure owners and groups, similar to HDFS.

    Apache Ranger (both modes): Supports advanced access control, including wildcards in paths.

    You cannot switch between block storage mode and cache mode.
    JindoFS permissions

    Enable Unix-based permission management

    Unix-based permissions are available only in block storage mode.

    Prerequisites

    Before you begin, ensure that you have:

    • An E-MapReduce (EMR) cluster with the SmartData service deployed

    • Access to the Alibaba Cloud EMR console

    • Cluster admin permissions

    Configure and restart

    1. Go to the SmartData service.

      1. Log on to the Alibaba Cloud EMR console.

      2. In the top navigation bar, select the region where your cluster resides. Select the resource group as required. By default, all resources of the account appear.

      3. Click the Cluster Management tab.

      4. On the Cluster Management page, find the target cluster and click Details in the Actions column.

      5. In the left-side navigation pane, click Cluster Service and then SmartData.

    2. Go to the namespace tab for the SmartData service.

      1. Click the Configure tab.

      2. Click the namespace tab in the Service Configuration section. namespace_smartdata

    3. Click Custom Configuration in the upper-right corner. In the Add Configuration Item dialog box, set Key to jfs.namespaces.<namespace>.permission.method and Value to unix, and click OK.

    4. Save the configurations.

      1. In the upper-right corner of the Service Configuration section, click Save.

      2. In the Confirm Changes dialog box, enter a description and turn on Auto-update Configuration.

      3. Click OK.

    5. Restart the Namespace Service.

      1. Choose Actions > Restart Jindo Namespace Service in the upper-right corner.

      2. In the Cluster Activities dialog box, enter a description and click OK. In the confirmation message, click OK.

    After the service restarts, manage JindoFS permissions with the same Unix commands you use for HDFS:

    hadoop fs -chmod 777 jfs://{namespace_name}/dir1/file1
hadoop fs -chown john:staff jfs://{namespace_name}/dir1/file1

    If a user lacks permissions on a file, the following error is returned:

    error

    Enable Ranger-based permission management

    Ranger-based permissions are available in both block storage mode and cache mode.

    Prerequisites

    Before you begin, ensure that you have:

    • An EMR cluster with the Apache Ranger component installed

    • The Ranger plug-in activated in JindoFS

    • Access to the Ranger web UI

    Configure and restart

    1. Set Ranger as the permission method in JindoFS.

      1. On the namespace tab for the SmartData service, click Custom Configuration.

      2. In the Add Configuration Item dialog box, set Key to jfs.namespaces.<namespace>.permission.method and Value to ranger, and click OK.

      3. Save the configurations.

        1. In the upper-right corner of the Service Configuration section, click Save.

        2. In the Confirm Changes dialog box, enter a description and turn on Auto-update Configuration.

        3. Click OK.

      4. Restart the Namespace Service.

        1. Choose Actions > Restart Jindo Namespace Service in the upper-right corner.

        2. In the Cluster Activities dialog box, enter a description and click OK. In the confirmation message, click OK.

    2. Add the HDFS service on the Ranger web UI and configure the required parameters.

      1. Log on to the Ranger web UI. For more information, see Overview.

      2. Add the HDFS service on the Ranger web UI. Ranger UI

      3. Configure the following parameters.

        Parameter Description
        Service Name Use the format jfs-{namespace_name}. Example: jfs-test.
        Username Enter a custom username.
        Password Enter a custom password.
        Namenode URL Use the format jfs://{namespace_name}/.
        Authorization Enabled Keep the default value No.
        Authentication Type Keep the default value Simple.
        dfs.datanode.kerberos.principal Leave blank.
        dfs.namenode.kerberos.principal Leave blank.
        dfs.secondary.namenode.kerberos.principal Leave blank.
        Add New Configurations —

      4. Click Add.

    Enable LDAP user group synchronization in JindoFS

    When using Ranger permissions with LDAP-based Ranger Usersync, configure JindoFS to resolve LDAP user groups for permission checks.

    1. On the namespace tab for the SmartData service, click Custom Configuration.

    2. In the Add Configuration Item dialog box, configure the following LDAP parameters and click OK. Configure the parameters based on the open-source HDFS configuration. For more information, see core-default.xml.

      Parameter Example
      hadoop.security.group.mapping org.apache.hadoop.security.CompositeGroupsMapping
      hadoop.security.group.mapping.providers shell4services,ad4users
      hadoop.security.group.mapping.providers.combined true
      hadoop.security.group.mapping.provider.shell4services org.apache.hadoop.security.ShellBasedUnixGroupsMapping
      hadoop.security.group.mapping.provider.ad4users org.apache.hadoop.security.LdapGroupsMapping
      hadoop.security.group.mapping.ldap.url ldap://emr-header-1:10389
      hadoop.security.group.mapping.ldap.search.filter.user (&(objectClass=person)(uid={0}))
      hadoop.security.group.mapping.ldap.search.filter.group (objectClass=groupOfNames)
      hadoop.security.group.mapping.ldap.base o=emr

    3. Save the configurations.

      1. In the upper-right corner of the Service Configuration section, click Save.

      2. In the Confirm Changes dialog box, enter a description and turn on Auto-update Configuration.

      3. Click OK.

    4. Restart all components of the SmartData service.

      1. Choose Actions > Restart All Components in the upper-right corner.

      2. In the Cluster Activities dialog box, enter a description and click OK. In the confirmation message, click OK.

    5. Log on to the emr-header-1 node of the EMR cluster via SSH and connect Ranger Usersync to the LDAP server. For more information, see Integrate Ranger UserSync with an LDAP server server. After integration, you can grant LDAP users or user groups access permissions when you configure Ranger policies.").