diff --git a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
index 32979f6c1f8..91327db7559 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
+++ b/hadoop-hdfs-project/hadoop-hdfs/CHANGES.txt
@@ -923,6 +923,9 @@ Release 2.8.0 - UNRELEASED
 
     HDFS-9630. DistCp minor refactoring and clean up. (Kai Zheng via zhz)
 
+    HDFS-9415. Document dfs.cluster.administrators and
+    dfs.permissions.superusergroup. (Xiaobing Zhou via Arpit Agarwal)
+
   OPTIMIZATIONS
 
     HDFS-8026. Trace FSOutputSummer#writeChecksumChunks rather than
diff --git a/hadoop-hdfs-project/hadoop-hdfs/src/main/resources/hdfs-default.xml b/hadoop-hdfs-project/hadoop-hdfs/src/main/resources/hdfs-default.xml
index 4c5632645b4..30b7b538e62 100644
--- a/hadoop-hdfs-project/hadoop-hdfs/src/main/resources/hdfs-default.xml
+++ b/hadoop-hdfs-project/hadoop-hdfs/src/main/resources/hdfs-default.xml
@@ -414,17 +414,24 @@
 <property>
   <name>dfs.permissions.superusergroup</name>
   <value>supergroup</value>
-  <description>The name of the group of super-users.</description>
+  <description>The name of the group of super-users.
+    The value should be a single group name.
+  </description>
 </property>
-<!--
+
 <property>
    <name>dfs.cluster.administrators</name>
-   <value>ACL for the admins</value>
-   <description>This configuration is used to control who can access the
-                default servlets in the namenode, etc.
+   <value></value>
+   <description>ACL for the admins, this configuration is used to control
+     who can access the default servlets in the namenode, etc. The value
+     should be a comma separated list of users and groups. The user list
+     comes first and is separated by a space followed by the group list,
+     e.g. "user1,user2 group1,group2". Both users and groups are optional,
+     so "user1", " group1", "", "user1 group1", "user1,user2 group1,group2"
+     are all valid (note the leading space in " group1"). '*' grants access
+     to all users and groups, e.g. '*', '* ' and ' *' are all valid.
    </description>
 </property>
--->
 
 <property>
   <name>dfs.namenode.acls.enabled</name>