How grant/revoke in hive works with Ranger?

[#1]

This article just gives an example of how 'grant'/'revoke' works when the Hive plugin is enabled with Ranger in CDP.

A user who is 'admin' in Ranger, can manage access to Hive tables via 'grant'/'revoke' operation.

In Ranger UI > Settings > Users and Groups > Users

Note: User 'hive' is in role 'Admin'

On the beeline, login as user 'hive'. Run the grant command to give select privileges on a table:

0: jdbc:hive2://a.b.c.co> grant select on table mix to user mugdha;
INFO  : Compiling command(queryId=hive_20211021024819_c3de84a7-a312-4a1f-9a8d-8b328cced054): grant select on table mix to user mugdha
INFO  : Semantic Analysis Completed (retrial = false)
INFO  : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO  : Completed compiling command(queryId=hive_20211021024819_c3de84a7-a312-4a1f-9a8d-8b328cced054); Time taken: 0.022 seconds
INFO  : Executing command(queryId=hive_20211021024819_c3de84a7-a312-4a1f-9a8d-8b328cced054): grant select on table mix to user mugdha
INFO  : Starting task [Stage-0:DDL] in serial mode
INFO  : Completed executing command(queryId=hive_20211021024819_c3de84a7-a312-4a1f-9a8d-8b328cced054); Time taken: 0.548 seconds
INFO  : OK
No rows affected (0.634 seconds)

In Ranger, a new policy is created by that command:

Similarly, in a 'revoke' run, user 'mugdha', will be removed from the policy:

0: jdbc:hive2://a.b.c.co> revoke select on table mix from user mugdha;
INFO  : Compiling command(queryId=hive_20211021025423_cdf81a8a-df0d-4c40-9509-f4325d3ba112): revoke select on table mix from user mugdha
INFO  : Semantic Analysis Completed (retrial = false)
INFO  : Created Hive schema: Schema(fieldSchemas:null, properties:null)
INFO  : Completed compiling command(queryId=hive_20211021025423_cdf81a8a-df0d-4c40-9509-f4325d3ba112); Time taken: 0.032 seconds
INFO  : Executing command(queryId=hive_20211021025423_cdf81a8a-df0d-4c40-9509-f4325d3ba112): revoke select on table mix from user mugdha
INFO  : Starting task [Stage-0:DDL] in serial mode
INFO  : Completed executing command(queryId=hive_20211021025423_cdf81a8a-df0d-4c40-9509-f4325d3ba112); Time taken: 0.274 seconds
INFO  : OK
No rows affected (0.323 seconds)

This also works the same way in HDP, see ​Provide User Access to Hive Database Tables from the Command Line