org.apache.hadoop.ipc.RemoteException: User: root is not allowed to impersonate root

org.apache.oozie.servlet.XServletException: E0902: Exception occured: [org.apache.hadoop.ipc.RemoteException: User: root is not allowed to impersonate root]
	at org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:199)
	at org.apache.oozie.servlet.BaseJobsServlet.doPost(BaseJobsServlet.java:92)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
	at org.apache.oozie.servlet.JsonRestServlet.service(JsonRestServlet.java:285)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.apache.oozie.servlet.AuthFilter$2.doFilter(AuthFilter.java:126)
	at org.apache.hadoop.security.authentication.server.AuthenticationFilter.doFilter(AuthenticationFilter.java:372)
	at org.apache.oozie.servlet.AuthFilter.doFilter(AuthFilter.java:131)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.apache.oozie.servlet.HostnameFilter.doFilter(HostnameFilter.java:67)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
	at java.lang.Thread.run(Thread.java:662)
Caused by: org.apache.oozie.service.AuthorizationException: E0902: Exception occured: [org.apache.hadoop.ipc.RemoteException: User: root is not allowed to impersonate root]
	at org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:360)
	at org.apache.oozie.servlet.BaseJobServlet.checkAuthorizationForApp(BaseJobServlet.java:188)
	... 24 more
Caused by: org.apache.oozie.service.HadoopAccessorException: E0902: Exception occured: [org.apache.hadoop.ipc.RemoteException: User: root is not allowed to impersonate root]
	at org.apache.oozie.service.HadoopAccessorService.createFileSystem(HadoopAccessorService.java:393)
	at org.apache.oozie.service.AuthorizationService.authorizeForApp(AuthorizationService.java:325)
	... 25 more
Caused by: org.apache.hadoop.ipc.RemoteException: User: root is not allowed to impersonate root
	at org.apache.hadoop.ipc.Client.call(Client.java:1107)
	at org.apache.hadoop.ipc.RPC$Invoker.invoke(RPC.java:229)
	at com.sun.proxy.$Proxy24.getProtocolVersion(Unknown Source)
	at org.apache.hadoop.ipc.RPC.getProxy(RPC.java:411)
	at org.apache.hadoop.hdfs.DFSClient.createRPCNamenode(DFSClient.java:135)
	at org.apache.hadoop.hdfs.DFSClient.<init>(DFSClient.java:276)
	at org.apache.hadoop.hdfs.DFSClient.<init>(DFSClient.java:241)
	at org.apache.hadoop.hdfs.DistributedFileSystem.initialize(DistributedFileSystem.java:100)
	at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:1411)
	at org.apache.hadoop.fs.FileSystem.access$200(FileSystem.java:66)
	at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:1429)
	at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:254)
	at org.apache.oozie.service.HadoopAccessorService$2.run(HadoopAccessorService.java:385)
	at org.apache.oozie.service.HadoopAccessorService$2.run(HadoopAccessorService.java:383)
	at java.security.AccessController.doPrivileged(Native Method)
	at javax.security.auth.Subject.doAs(Subject.java:396)
	at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1149)
	at org.apache.oozie.service.HadoopAccessorService.createFileSystem(HadoopAccessorService.java:383)
	... 26 more

解决方案：

在core-site.xml添加如下属性，其中
hadoop.proxyuser.root.groups中的root是用户，value里面的root是group

<property>
      <name>hadoop.proxyuser.root.groups</name>
      <value>root</value>
      <description>Allow the superuser oozie to impersonate any members of the group group1 and group2</description>
 </property>


 <property>
      <name>hadoop.proxyuser.root.hosts</name>
      <value>localhost</value>
      <description>The superuser can connect only from host1 and host2 to impersonate a user</description>
  </property>