diff --git a/hadoop-common-project/hadoop-common/CHANGES.txt b/hadoop-common-project/hadoop-common/CHANGES.txt
index 8ecca7591a..500c0dd4e8 100644
--- a/hadoop-common-project/hadoop-common/CHANGES.txt
+++ b/hadoop-common-project/hadoop-common/CHANGES.txt
@@ -641,7 +641,11 @@ Release 0.23.0 - Unreleased
 
     HADOOP-7691. Fixed conflict uid for install packages. (Eric Yang)
 
-    HADOOP-7603. Set hdfs, mapred uid, and hadoop uid to fixed numbers. (Eric Yang)
+    HADOOP-7603. Set hdfs, mapred uid, and hadoop uid to fixed numbers. 
+    (Eric Yang)
+
+    HADOOP-7658. Fixed HADOOP_SECURE_DN_USER environment variable in 
+    hadoop-evn.sh (Eric Yang)
 
 Release 0.22.0 - Unreleased
 
diff --git a/hadoop-common-project/hadoop-common/src/main/packages/hadoop-setup-conf.sh b/hadoop-common-project/hadoop-common/src/main/packages/hadoop-setup-conf.sh
index 96a989fc39..3590507c36 100644
--- a/hadoop-common-project/hadoop-common/src/main/packages/hadoop-setup-conf.sh
+++ b/hadoop-common-project/hadoop-common/src/main/packages/hadoop-setup-conf.sh
@@ -270,11 +270,13 @@ if [ "${SECURITY_TYPE}" = "kerberos" ]; then
   HADOOP_DN_ADDR="0.0.0.0:1019"
   HADOOP_DN_HTTP_ADDR="0.0.0.0:1022"
   SECURITY="true"
+  HADOOP_SECURE_DN_USER=${HADOOP_HDFS_USER}
 else
   TASK_CONTROLLER="org.apache.hadoop.mapred.DefaultTaskController"
   HADDOP_DN_ADDR="0.0.0.0:50010"
   HADOOP_DN_HTTP_ADDR="0.0.0.0:50075"
   SECURITY="false"
+  HADOOP_SECURE_DN_USER=""
 fi
 
 if [ "${AUTOMATED}" != "1" ]; then
diff --git a/hadoop-common-project/hadoop-common/src/main/packages/templates/conf/hadoop-env.sh b/hadoop-common-project/hadoop-common/src/main/packages/templates/conf/hadoop-env.sh
index e14ca285d2..c2b55e4bdb 100644
--- a/hadoop-common-project/hadoop-common/src/main/packages/templates/conf/hadoop-env.sh
+++ b/hadoop-common-project/hadoop-common/src/main/packages/templates/conf/hadoop-env.sh
@@ -56,7 +56,7 @@ export HADOOP_CLIENT_OPTS="-Xmx128m ${HADOOP_CLIENT_OPTS}"
 #HADOOP_JAVA_PLATFORM_OPTS="-XX:-UsePerfData ${HADOOP_JAVA_PLATFORM_OPTS}"
 
 # On secure datanodes, user to run the datanode as after dropping privileges
-export HADOOP_SECURE_DN_USER=${HADOOP_HDFS_USER}
+export HADOOP_SECURE_DN_USER=${HADOOP_SECURE_DN_USER}
 
 # Where log files are stored.  $HADOOP_HOME/logs by default.
 export HADOOP_LOG_DIR=${HADOOP_LOG_DIR}/$USER