The CDAP Ambari Service erroneously uses the cdap_user variable for hdfs.user on both secure and insecure clusters. On secure clusters, this is correct, by accident. On insecure clusters, it's simply incorrect. Instead, the hdfs.user should always be "yarn" on insecure clusters due to how DefaultContainerExecutor works.
Version 4.0.2 of cdap-ambari-service has been pushed to the 4.0 APT/YUM repositories.
Version 3.5.3 and version 3.6.1 of cdap-ambari-service have been pushed to the 3.5/3.6 APT/YUM repositories.