Cloudera's Hue is using proxy authentication quite successfully
in our organization. I.e. Hue does LDAP authentication, and then impersonates to that specific user and all requests are made on behalf of that user (although `hue` is actual OS user that runs Hue service). Other Hadoop services are just configured to trust user `hue` to impersonate to other users.
It might be easier to implement Spark's multitenancy support through spark-submit's --proxy-user parameter.
(this is applicable to kerberized and non-kerberized environments)
See comments in
and https://issues.apache.org/jira/browse/SPARK-5493 (resolved in Spark 1.3)