Cloudera Security issue with Sentry

[#1]

Hi,

Me and my coworkers are trying to implement security with Sentry in a Cloudera Cluster (CDH 5.10.0), without success.
It's our first hadoop project, a PoC for a customer. Our main security requirement is grant/revoke select access to schemas/tables for HUE users.
Firstly, we setup a KDC server for Kerberos in order to centralize authentication then we followed the "Enable Kerberos" wizard in Cloudera Manager. Everything works fine.
After that, we added the Sentry Service then we followed the documentation to configure all services (in our case, HDFS, Hive, Hue).
All these services are up and running, but the HUE admin user doesn't have permission to manage permissions in Security App.

After a lot of changes in configuration and after reading the entire security section in Cloudera Documentation, we didn't reach our goal.

We don't understand how to manage users/permissions in hadoop ecossytem.
How hue users, cloudera manager users, apps/system users (hue, hive, hdfs), kerberos principals, HDFS permissions and Sentry are related in order to work properly?

[#2 · Accepted solution]

Well, that topic is pretty broad. Let me try to help get you going.

Hadoop and all the tools that run on it will use Kerberos authentication now that it is configured.
User and group mappings will still be handled at the OS level though. So if you do not have LDAP and have it integrated at the OS level you will need to create local users and groups in the OS on all nodes.
Second, both CM and HUE have their own auth backend configuration and authorization. You can integrate both with LDAP, if you have it, or SAML/SSO. If not, you will need to create the users in those systems as well. The HUE users need to match the first portion, the username, of the principal in the KDC.

Now for the specific item you mentioned the HUE admin not having access to the Security app. HUE has its own groups and permissions. So you will need to add that user to have access to the Security app. You will need a HUE superuser account to do this (this is probably the HUE admin you mentioned).

[#3]

Thanks for your explanation @mbigelow. We'll setup and integrate an LDAP server in our environment. 

[#4]

Can you please explain if it is necessary, when integrating LDAP, still create users and groups on OS level or it needs for service users only such hive, impala, hdfs and etc? Whta is the role of SSSD or Centrify in this case? As I understand we can create various groups in LDAP and not in OS.