How do I grant different view access like Hive/Tez/File using ambari rest api calls ?

[#1]

Need curl calls to grant different view access through rest apis. I am currently able to create user and reset the password using ambari rest api as of now @Neeraj Sabharwal

[#2 · Accepted solution]

@Sushant Choudhary

Example: Suppose you want to give File View "Grant permission to these users" , The username is "jay" then you can make the following API call for the FileView.

# curl -i -u admin:admin -H "X-Requested-By: ambari" -X PUT  -d '[{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"amy_ds","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"holger_gov","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"maria_dev","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"raj_ops","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"jay","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"views","principal_type":"GROUP"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"CLUSTER.ADMINISTRATOR","principal_type":"ROLE"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"CLUSTER.OPERATOR","principal_type":"ROLE"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"SERVICE.OPERATOR","principal_type":"ROLE"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"SERVICE.ADMINISTRATOR","principal_type":"ROLE"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"CLUSTER.USER","principal_type":"ROLE"}}]'  http://localhost:8080/api/v1/views/FILES/versions/1.0.0/instances/AUTO_FILES_INSTANCE/privileges

.

[#3]

@Sushant Choudhary

From readability point i am posting the JSON data in the Pretty JSON format here.

[
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "amy_ds",
      "principal_type": "USER"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "holger_gov",
      "principal_type": "USER"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "maria_dev",
      "principal_type": "USER"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "raj_ops",
      "principal_type": "USER"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "jay",
      "principal_type": "USER"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "views",
      "principal_type": "GROUP"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "CLUSTER.ADMINISTRATOR",
      "principal_type": "ROLE"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "CLUSTER.OPERATOR",
      "principal_type": "ROLE"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "SERVICE.OPERATOR",
      "principal_type": "ROLE"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "SERVICE.ADMINISTRATOR",
      "principal_type": "ROLE"
    }
  },
  {
    "PrivilegeInfo": {
      "permission_name": "VIEW.USER",
      "principal_name": "CLUSTER.USER",
      "principal_type": "ROLE"
    }
  }

.

You can edit the PrivilegeInfo section from the above JSON data to give appropriate permission (principal_name)

.

[#4]

Is VIEW.USER permission specific to File view ? How do I grant access to Tez/Hive view. Any documentation on this ?

[#5]

@Sushant Choudhary

Granting permission is not different for Hive/Tez/File View or other Views. The curl call should be almost same. You need to just adjust the privilleges properly in the json. Please take a look at the "Hive View" granting example for user "jay"

Example For Hive

curl -i -u admin:admin -H "X-Requested-By: ambari" -X PUT  -d  '[{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"amy_ds","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"holger_gov","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"maria_dev","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"raj_ops","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"jay","principal_type":"USER"}},{"PrivilegeInfo":{"permission_name":"VIEW.USER","principal_name":"CLUSTER.ADMINISTRATOR","principal_type":"ROLE"}}]'  http://localhost:8080/api/v1/views/HIVE/versions/1.5.0/instances/AUTO_HIVE_INSTANCE/privileges

For more information of User Permissions for views please refer to:

- https://docs.hortonworks.com/HDPDocuments/Ambari-2.4.2.0/bk_ambari-views/content/section_user_permis...

- https://docs.hortonworks.com/HDPDocuments/Ambari-2.4.2.0/bk_ambari-views/content/section_user_permis...

[#6]

Hi Jay, I am trying to get all critical alerts from ambari using:

curl -u username:password -i -H 'X-Requested-By:ambari' -X GET http://ambari-server:8080/api/v1/clusters/clustername/alerts?Alert/state=CRITICAL

I don't want all fields here . For e.g I need service name and definition name , how to incorporate it in above curl

[#7]

@Sushant

If the original query that you asked as part of this thread is resolved and the previously provided updates helped you in answering your query then please mark this thread as "Accept" , that way it helps the community users to find a specific query and it's specific answer quickly.

I will suggest it will be great if oyu open a new Thread in HCC for your new query related to Alert.

[#8]

@Sushant

Also regarding your query on getting ambari CRITICAL alerts list please try:

curl -u username:password -i -H 'X-Requested-By:ambari' -X GET http://erie1.example.com:8080/api/v1/clusters/ErieCluster/alerts?fields=*&Alert/state.in(CRITICAL)

OR

curl -u username:password -i -H 'X-Requested-By:ambari' -X GET http://erie1.example.com:8080/api/v1/clusters/ErieCluster/alerts?fields=*&Alert/state=CRITICAL

.

[#9]

@Sushant How can I create a read-only user by ambari Rest API

[#10]

@jack jack

First you should open a new HCC thread that way each individual queries are tracked separately.