question Re: Hive Ranger policy is not applied in Archives of Support Questions (Read Only)

Hive Ranger policy is not applied

kamlepooja_raje — Wed, 26 Oct 2016 16:42:34 GMT

Hi,

I am trying to apply Ranger policies for Hive. I have created a policy but it seems that the policy is not applied. The audit logs that are shown in Ranger-> Audit are also confusing. I am trying to execute queries from Hive CLI.

I have a database called 'employee'. I have created a table empdetails having columns empno, empname and salary.

When I query 'select empno from empdetails' , it still shows me all the records as the policy states only 'empname' must be accessible by user 'mohang'.

It would be helpful if some one can provide some solution and suggestions. Attached are the screenshots.

Thanks.

Re: Hive Ranger policy is not applied

dsharma — Wed, 26 Oct 2016 16:46:22 GMT

i guess you have some other policy too that is allowing this operation in hive, can you filter the audits with servicetype = hive , because the image you attached is having all the entries for hdfs audit

Re: Hive Ranger policy is not applied

tstebbens — Wed, 26 Oct 2016 16:47:11 GMT

@Pooja Kamle Ranger policies are not applied to Hive CLI which is old technology and may be phased out in the future. You should be using Beeline/JDBC/ODBC to connect to Hiveserver2.

Re: Hive Ranger policy is not applied

kamlepooja_raje — Wed, 26 Oct 2016 17:11:21 GMT

I have attached screenshot for hive audit. In this only "USE' access type audits are displayed for servicetype=Hive

Re: Hive Ranger policy is not applied

dsharma — Wed, 26 Oct 2016 17:53:17 GMT

there is no entry related to operation you performed , can you please check the correct time instance and as per Terry suggestion , are you using hive cli or hiveserver beeline ?

Re: Hive Ranger policy is not applied

vperiasamy — Wed, 26 Oct 2016 20:21:37 GMT

Ranger plugin works with Hive Server2. Can you use beeline?

Re: Hive Ranger policy is not applied

kamlepooja_raje — Thu, 27 Oct 2016 11:59:50 GMT

Right now I am trying with Hive CLI as I am familiar with it. So, is it that the Ranger hive plugin won't work with Hive CLI at all?

Re: Hive Ranger policy is not applied

kamlepooja_raje — Thu, 27 Oct 2016 12:00:55 GMT

@vperiasamy

Yes, I understand from @Deepak Sharma and @Terry Stebbens that Hive Ranger plugin works with Beeline and not Hive CLI.

Re: Hive Ranger policy is not applied

dsharma — Thu, 27 Oct 2016 13:03:45 GMT

yes it will not work at all with hive cli , better you use beeline, thanks!