I am having Hive access errors. I suspect Ranger Permissions are involved.

[#1]

The error I'm getting when I go into Hive is this:

Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]

I suspect maybe Ranger isn't setup correctly? Is there a way to make sure all of my users I setup in Ambari are given permissions via Ranger?

[#2]

Full error:

    org.apache.ambari.view.hive.client.HiveInvalidQueryException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]

org.apache.ambari.view.hive.client.HiveInvalidQueryException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]
	at org.apache.ambari.view.hive.client.Utils.verifySuccess(Utils.java:46)
	at org.apache.ambari.view.hive.client.Connection.execute(Connection.java:614)
	at org.apache.ambari.view.hive.client.Connection.executeSync(Connection.java:629)
	at org.apache.ambari.view.hive.client.DDLDelegator.getDBListCursor(DDLDelegator.java:76)
	at org.apache.ambari.view.hive.client.DDLDelegator.getDBList(DDLDelegator.java:65)
	
[plus more that didn't fit]
  

Press CTRL + Space to autocomplete

You can execute queries with multiple SQL statements delimited by a semicolon ';'

You can highlight and run a fragment of a query

" style="box-sizing: border-box; display: block; font-stretch: normal; line-height: 1; font-family: FontAwesome; font-size: 20px; text-rendering: auto; -webkit-font-smoothing: antialiased; cursor: pointer; border-bottom: 1px solid rgb(221, 221, 221); padding: 10px;">SQLTEZ

[#3]

@Chris Colvin Pls check - https://community.hortonworks.com/questions/46013/error-while-compiling-statement-failed-hiveaccessc...

*** Create a hive policy in ranger to allow admin user to access hive

[#4]

how do I do that?

[#5]

@Sagar Shimpi same question as @Chris Colvin how do you go about that?

[#6]

@Chris Colvin

Please see the following link on how to use Ranger to give access to user admin (or a group admin belongs to). To make it work, I'll start with giving all access and then start restricting it and see how the behavior changes so the user has most restrictive access but still able to do the job.

https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+0.5+-+User+Guide#ApacheRanger0.5-Us...

[#7]

I created a rule in ranger that allowed select access to @null and default. It seems like a hack but it also seems to work.

[#8]

For me the following fixed it. Set the following configs on hive:

webhcat.proxyuser.root.groups *

webhcat.proxyuser.root.hosts *

[#9]

I had a similar issue. You may want to check Ranger > Audit > Plugin Status to see if the policy is being applied. If it's not it may be that you have a jersey-client classpath conflict. More details here:
https://jonmorisissqlblog.blogspot.com/2021/06/ranger-hive-policy-activation-time.html