According to the contract of UserGroupInformation.doAs() the only required operations within the doAs() block are the
creation of a JobClient or getting a FileSystem .
The DistributedCache.add(File/Archive)ToClasspath() methods create a FileSystem instance outside of the doAs() block,
this FileSystem instance is not in the scope of the proxy user but of the superuser and permissions may make the method
One option is to overload the methods above to receive a filesystem.
Another option is to do obtain the FileSystem within a doAs() block, for this it would be required to have the proxy
user set in the passed configuration.
The second option seems nicer, but I don't know if the proxy user is as a property in the jobconf.