question Re: What is the best way to implement row-based security in Hive? in Archives of Support Questions (Read Only)

What is the best way to implement row-based security in Hive?

rmccollam — Fri, 09 Oct 2015 02:09:41 GMT

Re: What is the best way to implement row-based security in Hive?

abajwa — Fri, 09 Oct 2015 02:15:00 GMT

I believe this would currently be through Hive views

Re: What is the best way to implement row-based security in Hive?

deepesh1 — Fri, 09 Oct 2015 02:49:39 GMT

Row based security can be achieved through SQL Standard Based Hive Authorization.You can create a view with the filter from the original table and then GRANT permissions to role or individual user.

Re: What is the best way to implement row-based security in Hive?

awatson — Fri, 09 Oct 2015 02:57:26 GMT

Just furthering adding to what Deepesh and Ali said - Create Hive views that would filter out rows and then use Ranger to grant that user access to that View (and not the underlying table).

Re: What is the best way to implement row-based security in Hive?

jpp — Fri, 09 Oct 2015 05:32:51 GMT

Row-level security can be achieved by defining views with hard-coded permissions in Ranger.

An alternative available since Hive 1.2.0 is to filter dynamically based on the current user, with the current_user() function. This provides row-by-row security. One option to define the ACLs is via a permission table:

create table permission( username string, driverid string);

For example to secure the driver(driverid, drivername) table, you could create the following permission:

insert into permission values( jsmith, 25 );

Finally define the view by joining against it:

create view secure_driver AS select d.* from driver d inner join permissions p on d.driverid=p.driverid where username = current_user();

Re: What is the best way to implement row-based security in Hive?

nsabharwal — Sat, 10 Oct 2015 19:40:10 GMT

@Ronald McCollam

Hive view and if we look into other technology stacks then Row level security is based on views.

Re: What is the best way to implement row-based security in Hive?

bganesan — Tue, 03 Nov 2015 02:31:33 GMT

We would recommend customers to use Ranger with Hive, rather than SQL std authorization. The solution recommend by JP would work

Re: What is the best way to implement row-based security in Hive?

bganesan — Tue, 03 Nov 2015 02:33:09 GMT

Though views are not a scalable model, this would be the best recommended solution till the time we have support for inserting predicate or filtering row through UDF in Hive.

Re: What is the best way to implement row-based security in Hive?

LesterMartin — Sun, 06 Mar 2016 04:02:39 GMT

I know... I'm the FIFTH person to say create a View and secure permissions on it, and the backing table, appropriately. 😉

That said, I've got a simple little demo posted at https://github.com/HortonworksUniversity/Essentials/blob/master/demos/ranger/README.md along with a video recording of it linked there in case anyone might find that useful.

Re: What is the best way to implement row-based security in Hive?

rabberbo — Wed, 23 Nov 2016 03:10:23 GMT

Ranger now supports row filtering where you can specify a condition to filter the results by even without creating a new hive view.

https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.0/bk_security/content/ranger_row_level_filtering_in_hive.html