Support Questions
Find answers, ask questions, and share your expertise

I am having Hive access errors. I suspect Ranger Permissions are involved.

New Contributor

The error I'm getting when I go into Hive is this:

Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]

I suspect maybe Ranger isn't setup correctly? Is there a way to make sure all of my users I setup in Ambari are given permissions via Ranger?

8 REPLIES 8

New Contributor

Full error:

    org.apache.ambari.view.hive.client.HiveInvalidQueryException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]

org.apache.ambari.view.hive.client.HiveInvalidQueryException: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [admin] does not have [USE] privilege on [null] [ERROR_STATUS]
	at org.apache.ambari.view.hive.client.Utils.verifySuccess(Utils.java:46)
	at org.apache.ambari.view.hive.client.Connection.execute(Connection.java:614)
	at org.apache.ambari.view.hive.client.Connection.executeSync(Connection.java:629)
	at org.apache.ambari.view.hive.client.DDLDelegator.getDBListCursor(DDLDelegator.java:76)
	at org.apache.ambari.view.hive.client.DDLDelegator.getDBList(DDLDelegator.java:65)
	
[plus more that didn't fit]
  
  • Press CTRL + Space to autocomplete
  • You can execute queries with multiple SQL statements delimited by a semicolon ';'
  • You can highlight and run a fragment of a query
  • " style="box-sizing: border-box; display: block; font-stretch: normal; line-height: 1; font-family: FontAwesome; font-size: 20px; text-rendering: auto; -webkit-font-smoothing: antialiased; cursor: pointer; border-bottom: 1px solid rgb(221, 221, 221); padding: 10px;">SQLTEZ

    @Chris Colvin Pls check - https://community.hortonworks.com/questions/46013/error-while-compiling-statement-failed-hiveaccessc...

    *** Create a hive policy in ranger to allow admin user to access hive

    New Contributor

    how do I do that?

    @Sagar Shimpi same question as @Chris Colvin how do you go about that?

    Super Guru
    @Chris Colvin

    Please see the following link on how to use Ranger to give access to user admin (or a group admin belongs to). To make it work, I'll start with giving all access and then start restricting it and see how the behavior changes so the user has most restrictive access but still able to do the job.

    https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+0.5+-+User+Guide#ApacheRanger0.5-Us...

    I created a rule in ranger that allowed select access to @null and default. It seems like a hack but it also seems to work.

    For me the following fixed it. Set the following configs on hive:

    webhcat.proxyuser.root.groups *

    webhcat.proxyuser.root.hosts *

    Explorer

    I had a similar issue. You may want to check Ranger > Audit > Plugin Status to see if the policy is being applied. If it's not it may be that you have a jersey-client classpath conflict. More details here:
    https://jonmorisissqlblog.blogspot.com/2021/06/ranger-hive-policy-activation-time.html

    Take a Tour of the Community
    Don't have an account?
    Your experience may be limited. Sign in to explore more.