YARN-2656, if people set hadoop.proxyuser for the client<-->RM RPC interface, it's not going to work, because ProxyUsers#sip is a singleton per daemon. After YARN-2656, RM has both channels that want to set this configuration: RPC and HTTP. RPC interface sets it first by reading hadoop.proxyuser, but it is overwritten by HTTP interface, who sets it to empty because yarn.resourcemanager.webapp.proxyuser doesn't exist.
The fix for it could be similar to what we've done for
YARN-2676: make the HTTP interface anyway source hadoop.proxyuser first, then yarn.resourcemanager.webapp.proxyuser.