Support Questions

Find answers, ask questions, and share your expertise

Query with transform clause is disallowed in current configuration

avatar
Super Collaborator
2015-12-09 09:14:54,306 ERROR [HiveServer2-Background-Pool: Thread-60853]: ql.Driver (SessionState.java:printError(833)) - FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.)
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: Query with transform clause is disallowed in current configuration.
        at org.apache.hadoop.hive.ql.security.authorization.plugin.DisallowTransformHook.run(DisallowTransformHook.java:34)
        at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:1304)
        at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:1177)
        at org.apache.hadoop.hive.ql.Driver.run(Driver.java:1004)
        at org.apache.hadoop.hive.ql.Driver.run(Driver.java:999)
        at org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:144)
        at org.apache.hive.service.cli.operation.SQLOperation.access$100(SQLOperation.java:69)
        at org.apache.hive.service.cli.operation.SQLOperation$1$1.run(SQLOperation.java:196)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAs(Subject.java:415)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1628)
        at org.apache.hadoop.hive.shims.HadoopShimsSecure.doAs(HadoopShimsSecure.java:536)
        at org.apache.hive.service.cli.operation.SQLOperation$1.run(SQLOperation.java:208)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
        at java.util.concurrent.FutureTask.run(FutureTask.java:262)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:745)
14 REPLIES 14

avatar
Super Collaborator

Thanks Neeraj for your swift response.

we are able to run this query with no issues when we run it in HiveCli which is not recommended. Encountered this error when we run it in beeline.

Hive version we have is 0.14.0.2.2.0.0

If it runs well with HiveCli, i believe it should run with Beeline too...i think it got some thing to do with authentication.

since hiveserver2.log reports: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: Query with transform clause is disallowed in current configuration btw: we use beeline as hive client and make connection through Knox, which authenticates against our AD & authorize through Ranger

avatar
Master Mentor

@Raja Sekhar Chintalapati Ranger works with beeline. You will expect different behavior when you run hive cli thats why the best practice is to avoid hive and stick with beeline

avatar
Super Collaborator

@Neeraj Sabharwal is there any fix for this issue? like change in some parameter or anything? when the query failed with above error it doesn't even report in ranger audit.

avatar
Master Mentor

@Raja Sekhar Chintalapati Transform is disabled for secruity reasons. You have a workaround, hive cli.

avatar
Super Collaborator

isn't HiveCli is not secured? there is no authentication too...

avatar

Hive CLI is unsecured. You can run any scripts with it. To secure Hive CLI you need to secure the HDFS files directly. See Section 3 in Best Practices for Hive Authorization using Apache Ranger

avatar
Contributor
@Neeraj Sabharwal

we are using Hive-1.2 and Ranger-0.5, we have provided all access to users using Ranger but still it;s giving below error.

0: jdbc:hive2://sandbox:10000/default> select transform(joining_date) using 'datefunc.py' as t from default.employee; Error: Error while processing statement: FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.) (state=08S01,code=12)

Could you please help me resolve the same.

Thanks,

Bhavesh Vadaliya

avatar
Master Mentor
@Raja Sekhar Chintalapati

Transform function is disabled when hive security is enabled. You can follow this http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-...

to grant permission to transform udf and see if it works.