title: HDFS encryption: User:hdfs not allowed to do 'DECRYPT_EEK' on 'hdfskey'
body: <p>I'm trying to setup HDFS encryption with Ranger KMS on HDP 2.4.</p>
  
  <p>I was able to deploy and configure the KMS service. I've created a key and an access policy to grant all permissions to hdfs user for operating with this key. </p>
  
  <p>I'm able to create an encrypted zone with</p>
  
  <pre><code>sudo -uhdfs hdfs mkdir /data_enc
  sudo -uhdfs hdfs crypto -createZone -keyName hdfskey  -path /data_enc
  </code></pre>
  
  <p>However when I try to put a file into the directory, I get this error:</p>
  
  <pre><code>    sudo -uhdfs hdfs dfs -put /tmp/file.txt /data_enc/
  ...
      User:hdfs not allowed to do 'DECRYPT_EEK' on 'hdfskey'
  </code></pre>
  
  <p>hdfs user has all permissions for this key, including DECRYPT_EEK. Does anyone knows what could go wrong?</p>