Managing Hive UDFs Using Ranger

[#1]

Which Hive permissions do I need to set if I want to allow some users to use a certain UDF? Available Hive permissions are: create, drop, alter, select, update, index, lock but what I need for UDF is a kind of "allow" . Also, do I have to set "Delegate admin"?

[#2 · Accepted solution]

This is Hive UDF Allow in Sandbox. And no you do not have to set Delegate Admin.

[#3]

@Ancil McBarnett Thanks for a quick reply. My question is do I have to set all those permissions at the bottom? And in this screenshot "Delegate admin" is checked.

[#4]

if you just want to execute it, select is only needed. Remember UDFs are used in DDL and DML in a Hive Statement. So Select means you can use a UDF in a Select Statement in SQL.

[#5]

Okay, that makes sense: Accepted!

[#6]

Hi, I have hive.server2.enable.doAs set to true.

I have created a hive policy for qaadmin user to have access to only initcap() UDF which is builtin Hive UDF. But qaadmin user can access other built in UDFs too which user should not have access as per Hive Policy.

Note- qaadmin is only part of this policy.

Please help me how to make it work ?