Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

I am having Hive access errors. I suspect Ranger Permissions are involved.

avatar
New Contributor

The error I'm getting when I go into Hive is this:

Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]

I suspect maybe Ranger isn't setup correctly? Is there a way to make sure all of my users I setup in Ambari are given permissions via Ranger?

8 REPLIES 8

avatar
New Contributor

Full error:

    org.apache.ambari.view.hive.client.HiveInvalidQueryException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]

org.apache.ambari.view.hive.client.HiveInvalidQueryException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]
	at org.apache.ambari.view.hive.client.Utils.verifySuccess(Utils.java:46)
	at org.apache.ambari.view.hive.client.Connection.execute(Connection.java:614)
	at org.apache.ambari.view.hive.client.Connection.executeSync(Connection.java:629)
	at org.apache.ambari.view.hive.client.DDLDelegator.getDBListCursor(DDLDelegator.java:76)
	at org.apache.ambari.view.hive.client.DDLDelegator.getDBList(DDLDelegator.java:65)
	
[plus more that didn't fit]
  
  • Press CTRL + Space to autocomplete
  • You can execute queries with multiple SQL statements delimited by a semicolon ';'
  • You can highlight and run a fragment of a query
  • " style="box-sizing: border-box; display: block; font-stretch: normal; line-height: 1; font-family: FontAwesome; font-size: 20px; text-rendering: auto; -webkit-font-smoothing: antialiased; cursor: pointer; border-bottom: 1px solid rgb(221, 221, 221); padding: 10px;">SQLTEZ

    avatar
    Super Guru

    @Chris Colvin Pls check - https://community.hortonworks.com/questions/46013/error-while-compiling-statement-failed-hiveaccessc...

    *** Create a hive policy in ranger to allow admin user to access hive

    avatar
    New Contributor

    how do I do that?

    avatar

    @Sagar Shimpi same question as @Chris Colvin how do you go about that?

    avatar
    Super Guru
    @Chris Colvin

    Please see the following link on how to use Ranger to give access to user admin (or a group admin belongs to). To make it work, I'll start with giving all access and then start restricting it and see how the behavior changes so the user has most restrictive access but still able to do the job.

    https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+0.5+-+User+Guide#ApacheRanger0.5-Us...

    avatar
    Contributor

    I created a rule in ranger that allowed select access to @null and default. It seems like a hack but it also seems to work.

    avatar
    Contributor

    For me the following fixed it. Set the following configs on hive:

    webhcat.proxyuser.root.groups *

    webhcat.proxyuser.root.hosts *

    avatar
    Explorer

    I had a similar issue. You may want to check Ranger > Audit > Plugin Status to see if the policy is being applied. If it's not it may be that you have a jersey-client classpath conflict. More details here:
    https://jonmorisissqlblog.blogspot.com/2021/06/ranger-hive-policy-activation-time.html