Updated on 2026-10-21 GMT+08:00

Managing MRS Cluster User Groups

User group management allows MRS cluster administrators to categorize cluster users and grant permissions in batches.

Typical applications include:

Permission isolation by business team: Create separate user groups for different business teams (such as data development, O&M, and data analysis) and assign roles to these groups to enforce permission isolation.
Batch permission assignment: When onboarding new employees or handing over projects, simply add users to the corresponding user group to grant them inherited permissions automatically, without configuring each user individually.
Centralized permission updates: When business requirements change, modify the roles assigned to a user group to update permissions for all group members at once.

Administrators can create and manage user groups based on service scenarios on MRS Manager. A user group is bound to a role to obtain operation permissions. After a user is added to a user group, the user can obtain the operation permissions of the user group. A user group can be used to classify users and manage multiple users.

Notes and Constraints

In MRS 3.x or later clusters, MRS Manager supports up to 5000 user groups, including built-in groups.
In MRS 2.x or earlier clusters, MRS Manager supports up to 100 user groups, including built-in groups.

Basic Concepts

User group: A logical unit on MRS Manager used to categorize users. Adding users to a group and assigning roles to that group enables batch authorization and centralized management. A user can belong to multiple user groups and inherits permissions from all assigned groups.
Role: A collection of permissions on MRS Manager that defines operation rights for cluster components and resources. Assigning a role to a user group grants those permissions to all group members. A user group can be assigned multiple roles.
Ranger: A centralized permission management framework in the Hadoop ecosystem. MRS integrates Ranger to provide fine-grained access control for components such as HDFS, Hive, and HBase. For components with Ranger authorization enabled, configure permission policies directly in Ranger rather than relying solely on MRS Manager roles.

Prerequisites

You have learned service requirements and created roles required by service scenarios.
You have logged in to Manager.

Creating a User Group

Log in to FusionInsight Manager of the MRS cluster.

For details about how to log in to FusionInsight Manager, see Accessing MRS Manager.
Choose System > Permission > User Group.
Above the user group list, click Create User Group.

Figure 1 Creating a user group

Set Group Name and Description.

**Table 1** Parameters for creating a user group
Parameter	Description
Group Name	The name of a user group. The name can contain 1 to 64 characters, including letters, digits, underscores (_), hyphens (-), and spaces. It is case-insensitive and cannot duplicate an existing user group name.
Description	Brief description to help identify and manage the user group.

In the Role area, click Add to select a role and add it.
- For components (except HDFS and YARN) with Ranger authorization enabled, the permissions of non-default roles on MRS Manager do not take effect. You need to configure Ranger policies to assign permissions to user groups.
- When HDFS or YARN resource requests go beyond the scope of Ranger policies, the access control list (ACL) rules defined within the components continue to take effect.
In the User area, click Add to select a user and add it.
Click OK.

The newly created user group appears in the user group list.

For MRS 2.x and earlier:

Log in to FusionInsight Manager of the MRS cluster.

For details about how to log in to FusionInsight Manager, see Accessing MRS Manager.
Click System.
In the Permission area, click Manage User Group.
Above the user group list, click Create User Group.

Set Group Name and Description.

**Table 2** Parameters for creating a user group
Parameter	Description
Group Name	The name of a user group. The name can contain 3 to 20 characters, including letters, digits, and underscores (_). It must be unique in the system.
Description	Brief description to help identify and manage the user group.

In Role, click Select and Add Role to select and add specified roles.

If you do not add the roles, the user group you are creating now does not have the permission to use MRS clusters.
Click OK.

Managing User Groups

Log in to FusionInsight Manager of the MRS cluster.

For details about how to log in to FusionInsight Manager, see Accessing MRS Manager.
Go to the user group management page.
- For MRS 3.x and later versions, choose System > Permission > User Group.
- For MRS 2.x and earlier versions, click System. In the Permission area, click Manage User Group.
In the user group list, perform the following operations on a user group as you need.
- Viewing user group information: By default, all user groups are displayed in the user group list. You can click the arrow on the left of a user group name to view details about the user group, including the user quantity, specific users, and bound roles of the user group.
- Modifying user group information: Locate the row that contains the user group to be modified and click Modify.
- Exporting user group information: Click Export All to export all user group information at a time in TXT or CSV format.
  Exporting user group information is supported only in MRS 3.x or later.
  
  The user group information contains the user group name, description, user list, and role list.
- Deleting a user group: Locate the row that contains the target user group and click Delete. To delete multiple user groups in batches, select the target user groups and click Delete above the user group list. A user group that contains users cannot be deleted. To delete such a user group, delete all its users by modifying the user group first.
  Deleted user groups cannot be recovered. Delete user groups during off-peak hours.

FAQs

Q: Do permissions take effect immediately after a user is added to a user group?

A: Permissions usually take effect immediately. However, if a user is currently logged in to MRS Manager, they must log out and log in again, or wait for the session to refresh, before the new permissions take effect.

Q: Can a user belong to multiple user groups?

A: Yes. A user can belong to multiple user groups and inherits permissions from all assigned groups. When a user belongs to multiple groups, their effective permissions are the combination (union) of all group permissions.

Q: What extra steps are required after I assign a role to a user group for a Ranger-enabled component?

A: For components with Ranger authorization enabled (excluding HDFS and YARN), you must also configure access policies for the user group on the Ranger UI. Otherwise, the assigned permissions will not take effect.

Helpful Links

For details about creating, modifying, and deleting cluster users, see Managing MRS Cluster Users.
For details about creating custom roles and configuring permission policies, see Creating a Role.

Parent Topic: Managing MRS Cluster Users