question Re: Ranger implementation - Hive impersonation false in Support Questions

Ranger implementation - Hive impersonation false

hrongali — Fri, 30 Oct 2015 01:59:20 GMT

Customer wants Hive column level ACLs to be set up in Ranger, so we suggested to set Hive doAs property to 'false' to impersonate as hive user and set Hive Column level ACLs in ranger. In this case all the jobs will be shown as to run as 'hive' user in Resource manager. At the same time, customer wants to know the resource utilization at the user level. Which is not possible because all the jobs will be run as hive user. Is there a way out to satisfy customer's requirement ? Thanks

Re: Ranger implementation - Hive impersonation false

nsabharwal — Fri, 30 Oct 2015 02:27:21 GMT

Set enable.doAs to "False"...This is really good explanation Link

When set to "false," the Hive user identity is used instead of the individual user identities for YARN. This setting enhances security and reuse:

hive.server2.enable.doAs=false

Note When doAs is set to false, queries execute as the Hive user and not the end user. When multiple queries run as the Hive user, they can share resources. Otherwise, YARN does not allow resources to be shared across different users. When the Hive user executes all of the queries, a Tez session opened for one query and is holding onto resources can use those resources for the next query without re-allocation.

Re: Ranger implementation - Hive impersonation false

hrongali — Fri, 30 Oct 2015 02:40:11 GMT

In that case, if the admin wants to see how much resources (lets say number of containers & vcores) used by a particular user 'user1', how can he get those statistics ?

Re: Ranger implementation - Hive impersonation false

nsabharwal — Fri, 30 Oct 2015 03:10:36 GMT

This is applicable to Hive only. Non-Hive/Yarn jobs will be coming from users running the job.

@hrongali@hortonworks.com

Re: Ranger implementation - Hive impersonation false

hrongali — Tue, 10 Nov 2015 00:58:06 GMT

The below Blog provides very good guideline too:

http://hortonworks.com/blog/best-practices-for-hive-authorization-using-apache-ranger-in-hdp-2-2/

Re: Ranger implementation - Hive impersonation false

Mark_Petronic — Tue, 03 May 2016 04:27:26 GMT

@Neeraj Sabharwal, I'm a bit confused on this impersonation concept. I understand the resource reuse benefits part. But, if I have different users running Hive queries and they all run as the "hive" user, then what is to prevent one user's "insert overwrite directory "some_relative_dir" select from ...." results from overwriting some other users query that just happens to pick the same directory path? If a relative path is supplied, then Hive will write the results to "/user/hive/some_relative_dir".

I tried to read the best practices link at the end of this post but the page is not loading.