Authorizing dse client-tool spark and dse spark

To run the dse client-tool spark or dse spark using a non-superuser role, authorize the role to EXECUTE on the following resource:

  • REMOTE OBJECT DseClientTool

When an unauthorized user attempts to run the command, launch a spark console session, as shown in the following example:

dse -u jane -p password spark

An unauthorized error displays:

The log file is at /home/automaton/.spark-shell.log
ERROR 2018-07-10 19:23:04,382 org.apache.spark.deploy.DseSparkSubmitBootstrapper: Failed to start or submit Spark application because of com.datastax.driver.core.exceptions.UnauthorizedException: User jane has no EXECUTE permission on <rpc method DseClientTool.getSparkMetricsConfig> or any of its parents - see details in the log file(s): /home/automaton/.spark-shell.log
ERROR 2018-07-10 19:23:04,682 org.apache.spark.deploy.DseSparkSubmitBootstrapper: Failed to cancel delegation token


  1. Log in to cqlsh with an account that has authorization permission on remote objects.

    cqlsh -u sec_admin
  2. Give EXECUTE permission to the role.

  3. Optional: Test that a user with the role, for example, jane, can execute a command.

    dse -u jane -p password spark
    The log file is at /home/automaton/.spark-shell.log
    Creating a new Spark Session
    Welcome to
          ____              __
         / __/__  ___ _____/ /__
        _\ \/ _ \/ _ `/ __/  '_/
       /___/ .__/\_,_/_/ /_/\_\   version
    Using Scala version 2.11.8 (Java HotSpot(TM) 64-Bit Server VM, Java 1.8.0_152)
    Type in expressions to have them evaluated.
    Type :help for more information.

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000,