03-26-2018 12:24 AM - last edited on 03-26-2018 06:02 AM by cjervis
I am using sentry with hive/impala CDH version 5.10
Secured via AD kerberos and AD group.
Access to tables is done via sentry, and all users can see correct databases in impala as per grant option but some users cannot see the same tables in Hive.
03-26-2018 12:34 AM
The Hive screenshot you provide, does not indicate the problem, because in this screenshot wou have "default" database selected. So the "missing" info below is not regarding databases, but not tables exist in the default database.
Can you click on "default" on the top of the red box? It will move you to the upper level.
03-26-2018 02:11 AM
Logs from HUE and Hive would help. With screenshots, we can only guess what is happening.
In any case, you can check two things:
1) Check that Hive Server is running. This is not the case in my opinion because you should get an error in HUE. Just double check it. Impala connects to Hive Metastore, so it is not affected if Hive Server id down.
2) And most likely in my opinion, the users that cannot see databases, are not defined in the server where HiveServer is running. So Hive Server is not able to retrieve users' group and match it with a sentry rule. If you use LDAP/AD probably you have configured sssd (or equivalent) on each host. Check that this service is running and user info is fetched from LDAP/AD. If you have manually created users, then check that group info is correct.
03-26-2018 03:31 AM
Tricky part is that some users (with same permission) can see tables and some cannot like me.
We are using sssd, i have restarted it and did "id userid" command. Groups appear correct but still no hive tables.