...
Application-level impersonation means that every application has a single principal that all programs in that application run as, and that resources are accessed as. Any streams or datasets created by the application would be owned by that user.
Streams and datasets Datasets created outside of an application can be created with a principal. Otherwise, they would be owned by the principal defined for the namespace in which they are created.
...
To use application-level impersonation in CDAP, where applications , and datasets , and streams have their own owner and the operations performed in CDAP impersonate their respective owners, CDAP needs to have access to the owner principal and their associated keytabs.
...
The configured HDFS delegation token timeout must be longer than the configured stream partition duration (stream.partition.duration), which has a default value of one hour (3600000). It must also be larger than the log saver's maximum file lifetime (log.saver.max.file.lifetime.ms), which has a value of six hours (21600000).