Hadoop cluster security2: How to enable hadoop Service Level Authorization

Reference:
http://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/ServiceLevelAuth.html

Steps:

• Add following in core-site.xml:
          <!--For Service Level Authorization, together with hadoop-policy.xml-->
          <property>
                  <name>hadoop.security.authorization</name>
                  <value>true</value>
          </property>
• hadoop-policy.xml: Besides clinets related properties, all other services are just permitted to hadoop admin user. Here is user hadoop, group hadoop. Bold ones are for clients access control. 
  <configuration>
    <property>
      <name>security.client.protocol.acl</name>
      <value>chenfangfang,hadoop chenfangfang,hadoop</value>
      <description>ACL for ClientProtocol, which is used by user code
      via the DistributedFileSystem.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.client.datanode.protocol.acl</name>
      <value>chenfangfang,hadoop chenfangfang,hadoop</value>
      <description>ACL for ClientDatanodeProtocol, the client-to-datanode protocol
      for block recovery.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.datanode.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for DatanodeProtocol, which is used by datanodes to
      communicate with the namenode.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.inter.datanode.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for InterDatanodeProtocol, the inter-datanode protocol
      for updating generation timestamp.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.namenode.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for NamenodeProtocol, the protocol used by the secondary
      namenode to communicate with the namenode.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
  <property>
      <name>security.admin.operations.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for AdminOperationsProtocol. Used for admin commands.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.refresh.user.mappings.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for RefreshUserMappingsProtocol. Used to refresh
      users mappings. The ACL is a comma-separated list of user and
      group names. The user and group list is separated by a blank. For
      e.g. "alice,bob users,wheel".  A special value of "*" means all
      users are allowed.</description>
    </property>
  
    <property>
      <name>security.refresh.policy.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for RefreshAuthorizationPolicyProtocol, used by the
      dfsadmin and mradmin commands to refresh the security policy in-effect.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.ha.service.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for HAService protocol used by HAAdmin to manage the
        active and stand-by states of namenode.</description>
    </property>
  
    <property>
      <name>security.zkfc.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for access to the ZK Failover Controller
      </description>
    </property>
  
    <property>
      <name>security.qjournal.service.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for QJournalProtocol, used by the NN to communicate with
      JNs when using the QuorumJournalManager for edit logs.</description>
    </property>
  
    <property>
      <name>security.mrhs.client.protocol.acl</name>
      <value>chenfangfang,hadoop chenfangfang,hadoop</value>
      <description>ACL for HSClientProtocol, used by job clients to
      communciate with the MR History Server job status etc. 
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <!-- YARN Protocols -->
  
    <property>
      <name>security.resourcetracker.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for ResourceTrackerProtocol, used by the
      ResourceManager and NodeManager to communicate with each other.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.resourcemanager-administration.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for ResourceManagerAdministrationProtocol, for admin commands. 
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.applicationclient.protocol.acl</name>
      <value>chenfangfang,hadoop chenfangfang,hadoop</value>
      <description>ACL for ApplicationClientProtocol, used by the ResourceManager 
      and applications submission clients to communicate with each other.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.applicationmaster.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for ApplicationMasterProtocol, used by the ResourceManager 
      and ApplicationMasters to communicate with each other.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.containermanagement.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for ContainerManagementProtocol protocol, used by the NodeManager 
      and ApplicationMasters to communicate with each other.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.resourcelocalizer.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for ResourceLocalizer protocol, used by the NodeManager 
      and ResourceLocalizer to communicate with each other.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.job.task.protocol.acl</name>
      <value>hadoop hadoop</value>
      <description>ACL for TaskUmbilicalProtocol, used by the map and reduce
      tasks to communicate with the parent tasktracker.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.job.client.protocol.acl</name>
      <value>chenfangfang,hadoop chenfangfang,hadoop</value>
      <description>ACL for MRClientProtocol, used by job clients to
      communciate with the MR ApplicationMaster to query job status etc. 
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  
    <property>
      <name>security.applicationhistory.protocol.acl</name>
      <value>chenfangfang,hadoop chenfangfang,hadoop</value>
      <description>ACL for ApplicationHistoryProtocol, used by the timeline
      server and the generic history service client to communicate with each other.
      The ACL is a comma-separated list of user and group names. The user and
      group list is separated by a blank. For e.g. "alice,bob users,wheel".
      A special value of "*" means all users are allowed.</description>
    </property>
  </configuration>