question Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari in Archives of Support Questions (Read Only)

Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Sat, 03 Dec 2016 10:29:28 GMT

Hi All,

I've a kerberized HDP 2.4 - and i've created user - hive_user1

I logon to Hive View on Ambari, and fire simple query - select * from test

The error i get is shown below -

-------------------------------

Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [hdfs] does not have [SELECT] privilege on [default/test/sno] [ERROR_STATUS]

-----------------------------

Pls note - i've disabled Global access to Hive, but given access to user - hive_user1

But somehow, it is using hdfs user to access Hive.

Any ideas on this ?

attached is the screenshot of the user, and the error obtained.

screen-shot-2016-12-02-at-61927-pm.png

screen-shot-2016-12-02-at-62808-pm.png

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

Former Member — Sat, 03 Dec 2016 13:53:15 GMT

@Karan Alang

What is the value you have set for "hive.server2.enable.doAs" (true/false). By default HiveServer2 performs the query processing as the user who submitted the query. But if the following parameter is set to false, the query will run as the user that the hiveserver2 process runs as.

https://cwiki.apache.org/confluence/display/Hive/Setting+Up+HiveServer2#SettingUpHiveServer2-Impersonation

Also do you have Ranger installed in your cluster?

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

sunile_manjee — Sat, 03 Dec 2016 14:07:15 GMT

Is this external table? if so can you verify you have access to the underlying hdfs table. if you have impersonation turned on, then you have to control access from both hive and hdfs.

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

dkozlowski — Sat, 03 Dec 2016 14:35:47 GMT

@Karan Alang

If you have Kerberized cluster - the usual things to check:

> Setup HDFS Proxy User - http://docs.hortonworks.com/HDPDocuments/Ambari-2.2.2.0/bk_ambari_views_guide/content/_setup_HDFS_proxy_user.html

> Set Up Kerberos for Ambari Server - http://docs.hortonworks.com/HDPDocuments/Ambari-2.1.1.0/bk_Ambari_Security_Guide/content/_optional_set_up_kerberos_for_ambari_server.html#header

> Kerberos Setup for Hive Views - http://docs.hortonworks.com/HDPDocuments/Ambari-2.2.1.0/bk_ambari_views_guide/content/section_kerberos_setup_hive_view.html

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Sat, 03 Dec 2016 14:48:24 GMT

@Sunile Manjee, this is regular table .. not external table

Attaching the Table definition, also permissions at the hdfs level is as shown below -

I'm able to access the table - test - from the command line.

I'm currently trying to restrict access from the Hive View.

-------------------------------------------------------------------------------------------------------------

hive> dfs -ls /apps/hive/warehouse/;

Found 5 items drwxrwxrwx - hdfs hdfs 0 2016-12-01 22:32 /apps/hive/warehouse/test

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Sat, 03 Dec 2016 15:23:42 GMT

screen-shot-2016-12-02-at-112143-pm.png

@Sunile Manjee, @Daniel Kozlowski, @jss - attaching the screenshot of permissions on Ranger.

if i add user - hdfs - and provide read access - i'm able to access the table using HIVE VIEW.

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

Former Member — Sat, 03 Dec 2016 15:38:03 GMT

@Karan Alang

Good to know that you are able to access the table using HIVE VIEW after adding the permission from Ranger side.

Also regarding your query Where you said that Why do you still see [hdfs] user and you mentioned that "you have set "hive.server2.enable.doAs" is set to false in hive-site.xml

The hive.server2.enable.doAs – Impersonate the connected user, default true. Means the query processing as the user who submitted the query.

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Sat, 03 Dec 2016 15:38:04 GMT

@jss - this is set to false in hive-site.xml .. what should the value be set to ?

I tried changing to true, but the error is still the same

yes, ranger is installed, i'm changing permissions using Ranger.

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Sun, 04 Dec 2016 02:06:45 GMT

@jss - actually, this is not working as desired.. i don't want to put 'hdfs' as group within Ranger, instead i want to be able to control access using users - hive_user1 or hdfs_user2 (instead of using service account - hdfs for controlling access).

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Mon, 05 Dec 2016 08:01:42 GMT

@Sunile Manjee, @Daniel Kozlowski - the above steps you mentioned are already done, hence i'm able to access the HIVE VIEW on Kerberized HDP2.4

Attaching the screen shot of the HIVE VIEW config, made some minor change -now getting the following error ..

-------------------------------

Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [ambari-server] does not have [SELECT] privilege on [default/test/sno] [ERROR_STATUS]

-----------------

Any ideas on this ?

I'm able to access the Hive table if i add ambari-ranger to Ranger policy, but it is not able to access if i give only the users - hive_user1, hive_user2 acess to the table - 'test'ambari-hive-view-hdp24-1.pdf

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Mon, 05 Dec 2016 08:08:07 GMT

@Kuldeep Kulkarni - any ides on how to fix this ?

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Mon, 05 Dec 2016 08:08:33 GMT

@Daniel Kozlowski - pls see response to your note above.

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Mon, 05 Dec 2016 08:34:26 GMT

@Kuldeep Kulkarni, @Sunile Manjee, @Daniel Kozlowski

This is what i see in the logs ->

2016-12-04 23:54:35,491 INFO [HiveServer2-Handler-Pool: Thread-76]: security.SecureClientUtils (SecureClientUtils.java:getClientConnectionHandler(94)) - doAsUser: ambari-server

so, seem it is trying to access the HIve instance as user - ambari-user.. how do i get it to access Hive as custom users (hive_user1 or hive_user2)

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Mon, 05 Dec 2016 10:47:32 GMT

@Sunile Manjee -

when you say - if you have impersonation turned on (i.e. set hive.server2.enable.doAs = true), control access from both hive and hdfs - do you mean to say that i've to change the permissions in hdfs as well (i.e group) ?

what if impersonation is turned off ?

Pls. clarify.

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

dkozlowski — Mon, 05 Dec 2016 14:57:20 GMT

@Karan Alang

As previously mentioned:

> hive.server2.enable.doAs - Setting this property to true will have HiveServer2 execute Hive operations as the user making the calls to it - so set this property to TRUE

> review your hive view settings (see all 3 URLs I already posted) - based on what I can see, at least, Hive Authentication is incorrect. This is to be:

auth=KERBEROS;principal=hive/_HOST@EXAMPLE.COM;hive.server2.proxy.user=${username} - where EXAMPLE.COM is your REALM

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

karan_alang1 — Tue, 06 Dec 2016 07:55:55 GMT

@Daniel Kozlowski - thanks for your input on this, i was able to make this work !

The missing entry (as you mentioned) was ->

hive.server2.proxy.user=${username} in Hive Authorization

After adding this, i'm able to control access to Hive tables using Ranger .

However, there is still one issue which needs clarification .. the value of constant -> hive.server2.enable.doAs does not seem to be affecting behavior. Even when it is set to false (or true), the above behavior is seen.

Any ideas/comments on this ?

Re: Kerberized HDP 2.4 - getting error in using Hive View on Ambari

dkozlowski — Tue, 06 Dec 2016 14:18:24 GMT

@Karan Alang

Ensure you have: hive.server2.enable.doAs=true

Also set the following properties to *

hadoop.proxyuser.hive.hosts=*

hadoop.proxyuser.hive.groups=*

NOTE: I appreciate if you vote for all the answers that helped you fixing the problem.