question Re: Hive metastore authorization in Archives of Support Questions (Read Only)

Hive metastore authorization

ScipioTheElder — Mon, 29 Aug 2016 21:49:17 GMT

This is NOT about HiveServer2, but only on Hive metastore. Do we have only two choices on Hive metastore property hive.security.metastore.authorization.manager?

StorageBasedAuthorizationProvider
DefaultHiveMetastoreAuthorizationProvider

Re: Hive metastore authorization

mqureshi — Mon, 29 Aug 2016 21:58:24 GMT

@ScipioTheYounger I would say only one type of authorization is available for metastore and it is the Storage based. The second one is pretty useless. It's the legacy one and it allows users to grant themselves whatever permissions they want.

Re: Hive metastore authorization

RyanCicak — Mon, 29 Aug 2016 21:58:38 GMT

Hi @ScipioTheYounger

Yes - you are correct (StorageBasedAuthorizationProvider and DefaultHiveMetastoreAuthorizationProvider) are the two provided https://cwiki.apache.org/confluence/display/Hive/Storage+Based+Authorization+in+the+Metastore+Server

DefaultHiveMetastoreAuthorizationProvider = Hive's grant/revoke model

StorageBasedAuthorizationProvider = HDFS permission based model (which is recommended on the apache website)

More info here on configuring for the storage-based model https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.4.2/bk_Sys_Admin_Guides/content/ref-5422cb60-d1d5-425a-b719-ec7bd03ee5d3.1.html