Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Hive LLAP ranger insert issue (requires default table permission)

Solved Go to solution

Hive LLAP ranger insert issue (requires default table permission)

Expert Contributor

Using hdp 2.6.3 with LLAP in Zeppelin.

Hive impersonation = true

LLAP doas = false

insert into table myDatabase.test_sql values "test"

I get the following error message

shadehive.org.apache.hive.service.cli.HiveSQLException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [test] does not have [CREATE] privilege on [default/tmp_0218b93f51bf49afb291f47ca315ee57]

I do not have permissions to create tables in default.. only in myDatabase. How can i change where this internal temp table is being created so that it's not trying to write to default, but instead myDatabase which I do have full permissions on?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Hive LLAP ranger insert issue (requires default table permission)

Super Collaborator

Hi @Matt Andruff,

The approach I come got to know while on the DML operation is that, when we insert the data, it creates a temp table under the database you resides / rather the database you are trying to insert.

in your case, since you have not switch any database it is defaulted to "default" database (or you may selected default database) hence its trying to create the table underneath.

rather provisioning ranger policies for access on default database, use database to target/scratch database will avoid additional roles.

for the same issue you have raised there is an open Jria linked - https://issues.apache.org/jira/browse/HIVE-15317

Hope this helps !!

3 REPLIES 3

Re: Hive LLAP ranger insert issue (requires default table permission)

Expert Contributor

My question still stands... but I did fine a ranger work around. Ranger>Hive>default database policy. default database Allow create/select on table "tmp_*"

Re: Hive LLAP ranger insert issue (requires default table permission)

Super Collaborator

Hi @Matt Andruff,

The approach I come got to know while on the DML operation is that, when we insert the data, it creates a temp table under the database you resides / rather the database you are trying to insert.

in your case, since you have not switch any database it is defaulted to "default" database (or you may selected default database) hence its trying to create the table underneath.

rather provisioning ranger policies for access on default database, use database to target/scratch database will avoid additional roles.

for the same issue you have raised there is an open Jria linked - https://issues.apache.org/jira/browse/HIVE-15317

Hope this helps !!

Re: Hive LLAP ranger insert issue (requires default table permission)

Expert Contributor

Interestingly I did try "use" but zeppelin's SQL interpreter doesn't seem to track 'use database' between statements. Maybe that's an issue I should report. @bkosaraju I really appreciate the thorough answer.

Don't have an account?
Coming from Hortonworks? Activate your account here