question Re: Hive Metastore Authorization and how it is connected to Ranger in Archives of Support Questions (Read Only)

Hive Metastore Authorization and how it is connected to Ranger

benhadoop — Wed, 29 Mar 2017 22:38:14 GMT

Hi community,

I have a question about authorization for the Hive Metastore (not the HiveServer2). Cluster is HDP 2.5 and Kerberos is set up.

The Apache community recommends to use a StorageBasedAuthorizationProvider. I understand, how it gets the ACLs from the underlying filesystem.

In my situation, I have Ranger set up and want to handle most of authorization there - effectively making Hadoop native permissions unused (for instance by setting the to 000 on the Hive directories).

The question now is:

- When using the StorageBasedAuthorizationProvider: Will the Hive Metastore consider Ranger policies on HDFS warehouse directories in his decision, if a certain user can read/write to directory? Or do I have to use POSIX permissions or HDFS ACLs?

- Is the a better way to realize Hive Metastore authorization (Maybe a custom authorization provider for HiveMetastore, that connects to Ranger and uses Ranger Policies for HiveServer2)?

Thank you!

Re: Hive Metastore Authorization and how it is connected to Ranger

vperiasamy — Wed, 29 Mar 2017 22:42:27 GMT

There is an open community proposal - See https://issues.apache.org/jira/browse/RANGER-768 and https://issues.apache.org/jira/browse/RANGER-1247.

Re: Hive Metastore Authorization and how it is connected to Ranger

benhadoop — Wed, 29 Mar 2017 22:53:17 GMT

Thank you! This answers the second question.

Re: Hive Metastore Authorization and how it is connected to Ranger

vperiasamy — Tue, 04 Apr 2017 22:03:24 GMT

There is nothing specific to Hive Metastore in evaluating access to HDFS resources. If HDFS Ranger plugin is enabled, then Ranger policies in conjunction with HDFS ACLs will apply. If HDFS Ranger plugin is not enabled, only HDFS ACLs will apply.

Re: Hive Metastore Authorization and how it is connected to Ranger

benhadoop — Wed, 05 Apr 2017 03:18:13 GMT

Thank you for that answer.

I was not sure, if there are any specialities, as Hive did some custom checks for read/write rights until: https://issues.apache.org/jira/browse/HIVE-7583 and https://issues.apache.org/jira/browse/HDFS-6570