Query with transform clause is disallowed in current configuration

[#1]

2015-12-09 09:14:54,306 ERROR [HiveServer2-Background-Pool: Thread-60853]: ql.Driver (SessionState.java:printError(833)) - FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.)
org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: Query with transform clause is disallowed in current configuration.
        at org.apache.hadoop.hive.ql.security.authorization.plugin.DisallowTransformHook.run(DisallowTransformHook.java:34)
        at org.apache.hadoop.hive.ql.Driver.execute(Driver.java:1304)
        at org.apache.hadoop.hive.ql.Driver.runInternal(Driver.java:1177)
        at org.apache.hadoop.hive.ql.Driver.run(Driver.java:1004)
        at org.apache.hadoop.hive.ql.Driver.run(Driver.java:999)
        at org.apache.hive.service.cli.operation.SQLOperation.runQuery(SQLOperation.java:144)
        at org.apache.hive.service.cli.operation.SQLOperation.access$100(SQLOperation.java:69)
        at org.apache.hive.service.cli.operation.SQLOperation$1$1.run(SQLOperation.java:196)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAs(Subject.java:415)
        at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1628)
        at org.apache.hadoop.hive.shims.HadoopShimsSecure.doAs(HadoopShimsSecure.java:536)
        at org.apache.hive.service.cli.operation.SQLOperation$1.run(SQLOperation.java:208)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
        at java.util.concurrent.FutureTask.run(FutureTask.java:262)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at java.lang.Thread.run(Thread.java:745)

[#2]

@Raja Sekhar Chintalapati

Please see these details

https://issues.apache.org/jira/browse/HIVE-6415

https://cwiki.apache.org/confluence/display/Hive/L...

[#3]

Thanks Neeraj for your swift response.

we are able to run this query with no issues when we run it in HiveCli which is not recommended. Encountered this error when we run it in beeline.

Hive version we have is 0.14.0.2.2.0.0

If it runs well with HiveCli, i believe it should run with Beeline too...i think it got some thing to do with authentication.

since hiveserver2.log reports: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException: Query with transform clause is disallowed in current configuration btw: we use beeline as hive client and make connection through Knox, which authenticates against our AD & authorize through Ranger

[#4]

@Raja Sekhar Chintalapati Ranger works with beeline. You will expect different behavior when you run hive cli thats why the best practice is to avoid hive and stick with beeline

[#5]

@Neeraj Sabharwal is there any fix for this issue? like change in some parameter or anything? when the query failed with above error it doesn't even report in ranger audit.

[#6]

@Raja Sekhar Chintalapati Transform is disabled for secruity reasons. You have a workaround, hive cli.

[#7]

isn't HiveCli is not secured? there is no authentication too...

[#8]

Hive CLI is unsecured. You can run any scripts with it. To secure Hive CLI you need to secure the HDFS files directly. See Section 3 in Best Practices for Hive Authorization using Apache Ranger

[#9]

@Neeraj Sabharwal

we are using Hive-1.2 and Ranger-0.5, we have provided all access to users using Ranger but still it;s giving below error.

0: jdbc:hive2://sandbox:10000/default> select transform(joining_date) using 'datefunc.py' as t from default.employee; Error: Error while processing statement: FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.) (state=08S01,code=12)

Could you please help me resolve the same.

Thanks,

Bhavesh Vadaliya

[#10]

@Raja Sekhar Chintalapati

Transform function is disabled when hive security is enabled. You can follow this http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-...

to grant permission to transform udf and see if it works.

[#11]

Here is the Apache JIRA that discusses this. It is unresolved at the moment. It discusses why TRANSFORM clause is a security risk and disabled with SQL Authorization in Hive. - Server wide Control over Transform Clause in Hive

[#12]

@Raja Sekhar Chintalapati has this been resolved? Please accept best answer or provide your own solution.

[#13]

I followed the links provided, edited some of the security policies within Ranger, but I'm still not able to execute the Hive UDF. Here's my error msg:

Error while processing statement: FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.)

Does anyone have additional tips/advice that would allow me to run a Hive "transform" UDF (that is written in python)?

This seems to run fine when I use a Spark to call the UDF, but I'd like to compare the results to Hive as well.

Thanks!

[#14]

Any update , its 2018. I am gettiing the same error,

Error: Error while processing statement: FAILED: Hive Internal Error: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException(Query with transform clause is disallowed in current configuration.) (state=08S01,code=12)

[#15]

Any update on this?

I am getting same error as mentioned above even when I disabled Ranger