question Ranger Dynamic query rewrite available for hive? in Archives of Support Questions (Read Only)

Ranger Dynamic query rewrite available for hive?

sunile_manjee — Tue, 15 Nov 2016 05:12:13 GMT

Is dynamic query rewrite avialable for hive as it is In HDP 2.5 dynamic query rewrite via Ranger for SparkSQL?

Re: Ranger Dynamic query rewrite available for hive?

slachterman — Tue, 15 Nov 2016 08:37:09 GMT

Ranger supports row-level filtering for Hive in 2.5, and accomplishes this by dynamically rewriting the query. I believe LLAP is a dependency for row-level filtering in SparkSQL.

Re: Ranger Dynamic query rewrite available for hive?

azeltov — Sun, 18 Aug 2019 10:22:00 GMT

@Sunile Manjee Answer is Yes. In HDP 2.5 Spark Column Security is available with LLAP and Ranger integration

You get Fine-Grained Column Level Access Control for SparkSQL. Fully dynamic policies per user. Doesn’t require views. Use Standard Ranger policies and tools to control access and masking policies.

Flow:

1.SparkSQL gets data locations known as “splits” from HiveServer and plans query.

2.HiveServer2 authorizes access using Ranger. Per-user policies like row filtering are applied.

3.Spark gets a modified query plan based on dynamic security policy.

4.Spark reads data from LLAP. Filtering / masking guaranteed by LLAP server.