Ranger Policy change not affecting behavior

[#1]

I am working through tutorial 410, and I'm running into an issue in the Hive Grant/Revoke Permission Scenarios section. After disabling the global access policies and invoking beeline as the it1 user, I can confirm the initial behavior of receiving an AccessControlException when attempting to run

GRANT select, update on table xademo.customer_details to user network1;

However, after implementing the new policy for the user it1, I am encountering the same exact behavior in beeline (AccessControlException). The configuration of the policy looks identical to the screenshot in the walkthrough.

What am I missing and how can I troubleshoot further?

One additional note (see second screenshot), I am seeing the below configuration warning in Hive (I'm unsure whether this is related).

[#2 · Accepted solution]

you need to enable the delegate admin in you policy

[#3]

Thanks Deepak. So the screenshot is incorrect and needs to be updated? https://raw.githubusercontent.com/hortonworks/tutorials/hdp/assets/securing-hdfs-hive-hbase-with-kno...

Also, why would I want to delegate admin rights to the network1 user? I think the idea is for it1 to be able to grant permissions to network1 (but not for network1 to be able to grant permissions to any one else).

[#4]

here what i mean is you remove network1 from your policy and enabel the delegate admin (chekbox next to permissions) privilege for it1,

now if you login to beeline as it1 and try to run the command:

GRANT select, update on table xademo.customer_details to user network1;

then network1 will get grant privilege and will get added as user in the the policy that belong to the resource xademo.customer_details , and delegate admin prvilege will not be enabled for it , it should create new policy item for it

[#5]

@slachterman

for ex: i had policy for user1 with delegate admin yes on table t4 so i had run this command using user1

grant select,update on table t4 to user2

now my policy got new entry in it for user2 with select , update but delegate admin no as follows

screen-shot-2016-07-15-at-14334-am.png

[#6]

Thanks @deepak sharma, I will submit a Github issue as I believe this screenshot needs to be changed: https://raw.githubusercontent.com/hortonworks/tutorials/hdp/assets/securing-hdfs-hive-hbase-with-kno...

[#7]

I have encountered the same issue. After specifying the first user "it1" as "Delegating admin", managing grant/revokes worked. I guess, a better policy would be to create a admin user "hive_admin" and delegate all admin activities to this user.