question Re: Hive LLAP ranger insert issue (requires default table permission) in Archives of Support Questions (Read Only)

Hive LLAP ranger insert issue (requires default table permission)

matt_andruff — Thu, 05 Apr 2018 21:21:14 GMT

Using hdp 2.6.3 with LLAP in Zeppelin.

Hive impersonation = true

LLAP doas = false

insert into table myDatabase.test_sql values "test"

I get the following error message

shadehive.org.apache.hive.service.cli.HiveSQLException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [test] does not have [CREATE] privilege on [default/tmp_0218b93f51bf49afb291f47ca315ee57]

I do not have permissions to create tables in default.. only in myDatabase. How can i change where this internal temp table is being created so that it's not trying to write to default, but instead myDatabase which I do have full permissions on?

Re: Hive LLAP ranger insert issue (requires default table permission)

matt_andruff — Thu, 05 Apr 2018 21:56:36 GMT

My question still stands... but I did fine a ranger work around. Ranger>Hive>default database policy. default database Allow create/select on table "tmp_*"

Re: Hive LLAP ranger insert issue (requires default table permission)

bkosaraju — Fri, 06 Apr 2018 08:52:18 GMT

Hi @Matt Andruff,

The approach I come got to know while on the DML operation is that, when we insert the data, it creates a temp table under the database you resides / rather the database you are trying to insert.

in your case, since you have not switch any database it is defaulted to "default" database (or you may selected default database) hence its trying to create the table underneath.

rather provisioning ranger policies for access on default database, use database to target/scratch database will avoid additional roles.

for the same issue you have raised there is an open Jria linked - https://issues.apache.org/jira/browse/HIVE-15317

Hope this helps !!

Re: Hive LLAP ranger insert issue (requires default table permission)

matt_andruff — Sun, 08 Apr 2018 23:50:17 GMT

Interestingly I did try "use" but zeppelin's SQL interpreter doesn't seem to track 'use database' between statements. Maybe that's an issue I should report. @bkosaraju I really appreciate the thorough answer.