Hive Authentication Related class analysis

The current hive version is supported for authentication and authorization (plus billing is 3 A, haha),

The permission-related settings that are defined in the Java.org.apache.hadoop.hive.conf.HiveConf class of Hive are:

Hive_authorization_enabled ("hive.security.authorization.enabled",  false),    //whether to turn on permissions validation hive _authorization_manager ("Hive.security.authorization.manager",      " Org.apache.hadoop.hive.ql.security.authorization.DefaultHiveAuthorizationProvider "),   //default authorization implementation class hive _authenticator_manager ("Hive.security.authenticator.manager",  //  Default Authentication implementation class       "Org.apache.hadoop.hive.ql.security.HadoopDefaultAuthenticator"), Hive_metastore_authorization_manager (" Hive.security.metastore.authorization.manager ",  //metasotre service Authorization     " Org.apache.hadoop.hive.ql.security.authorization. "     +  "Defaulthivemetastoreauthorizationprovider"), Hive_metastore_authenticator_ MANAGER ("Hive.security.metastore.authenticator.manager",     " Org.apache.hadoop.hive.ql.security.HadoopDefaultMetastoreAuthenticator "), Hive_authorization_table_user_grants ( "Hive.security.authorization.cReatetable.user.grants ", " "),   //the following 4 items will define the permissions to create a table, here is a bug, previously Fixhive_authorization_table_group_ GRANTS ("hive.security.authorization.createtable.group.grants",     ""), Hive_authorization_ Table_role_grants ("hive.security.authorization.createtable.role.grants",  ""), Hive_authorization_table_ Owner_grants ("hive.security.authorization.createtable.owner.grants",     ""),

Authenticator related code in Org.apache.hadoop.hive.ql.security package

A brief explanation is as follows

1.HiveAuthenticationProvider is an interface that extends the configurable, the implementation class primarily needs to implement the GetUserName and GetUserName methods

The 2.SessionStateConfigUserAuthenticator implements the Hiveauthenticationprovider interface, which is used for testing and debugging, mainly the GetUserName method:

Public String GetUserName () {String newusername = sessionstate.getconf (). Get ("User.Name", ""). Trim ();  is to obtain the user if (Newusername.isempty ()) {return System. GetProperty ("User.Name") according to the User.Name setting; If it is empty, the user is set according to System.getproperty ("User.Name"), which can be obtained by-d<name>=<value> settings, not set as the current logged-on users} else {Retur    n Newusername; }  }

The 3.SessionStateUserAuthenticator implements the Hiveauthenticationprovider interface, which is the class used by Hiveserver2 for verification.

4.ProxyUserAuthenticator extended the Hadoopdefaultauthenticator, overriding the Setconf method, The main invocation of the Usergroupinformation class Createremoteuser method, can do proxy user class (according to Proxy.user.name settings to get username)

5. Because the default Hive.security.authenticator.manager setting is Org.apache.hadoop.hive.ql.security.HadoopDefaultAuthenticator, we mainly look at the Hadoo In the Pdefaultauthenticator class, the primary method is when the Setconf method is

  public void setconf (configuration conf)  {       this. conf = conf;    usergroupinformation ugi = null;     try {      ugi = shimloader.gethadoopshims (). getugiforconf (conf);     } catch  (EXCEPTION E)  {       throw new runtimeexception (e);    }     if  (ugi == null)  {      throw new  RuntimeException (           "can not initialize  hadoopdefaultauthenticator. "  );    }    this. username =  Shimloader.gethadoopshims (). Getshortusername (UGI);    if  (Ugi.getgroupnames ()  !=  null)  {&nbsP;     this. groupnames = arrays.aslist (Ugi.getGroupNames ());     }  }

According to the analysis code, the user that Hive uses to authenticate is initialized when the first command is run (which does not take effect even though the settings are passed) because when the hive CLI starts, the. hiverc file is read run create temporary FUNCTION xxxx, At the first create XXX runtime, in the compile phase of the command (that is, the Driver.compile () method):

if  (Hiveconf.getboolvar (conf,     hiveconf.confvars.hive_authorization_enabled))  {  //  determine if hive.security.authorization.enabled is set to true   try {      perflogger.perflogbegin (class_name, perflogger.do_authorization);      doauthorization (SEM);  //  If authentication is turned on, call the Doauthorization method    }  catch  (AUTHORIZATIONEXCEPTION AUTHEXP)  {     console.printerror ( "Authorization failed:"  + authexp.getmessage ()           +  ".  use show grant to get more details.");      errormessage = authexp.getmessage ();      sqlstate =  "42000";      return 403;   } finally  {     perflogger.peRflogend (class_name, perflogger.do_authorization);    }} 

Doauthorization Method

Private void doauthorization (Basesemanticanalyzer sem)   throws hiveexception,  authorizationexception {  hashset<readentity> inputs = sem.getinputs ();   hashset<writeentity> outputs = sem.getoutputs ();   SessionState  ss = sessionstate.get ();   hiveoperation op = ss.gethiveoperation ();   //  Judging operation type   hive db = sem.getdb ();  if  ( Ss.isauthorizationmodev2 ())  {  //  If V2 is called, the DoAuthorizationV2 method is invoked, And the Sessionstate.isauthorizationmodev2 method invokes the Sessiontstate.getauthorizationmode method      DoAuthorizationV2 (ss, op, inputs, outputs);    return;  }   if  (op == null)  {     throw new hiveexception (" Operation should not be null ");   }  if  (Op.equals (hiveoperation.createdatabase))  {   //The following code is doing a specific validation operation, Involves Authorizator class       ss.getauthorizer (). Authorize (...

Sessionstate.isauthorizationmodev2 and Sessiontstate.getauthorizationmode methods:

  public authorizationmode getauthorizationmode () {  //determines the type of authorization (v1  OR V2)     setupauth ();  //Call Sessiontstate.setupauth method      if (authorizer != null) {      return authorizationmode.  v1;    }else if (authorizerv2 != null) {       return AuthorizationMode. V2;    }    //should  Not happen - this should not get called before this.start ()   Is called    throw new assertionerror ("Authorization plugins not  initialized! "  )   }  public boolean isauthorizationmodev2 () {     Return getauthorizationmode ()  == authorizationmode. v2;  }

Sessiontstate Method of Setupauth:

private void Setupauth () {if (authenticator! = NULL) {////If it has already been initialized, it is returned directly, which results in the subsequent setting of the user even if manual settings are not in effect//auth has been initial  ized return; try {authenticator = hiveutils.getauthenticator (conf, HiveConf.ConfVars.HIVE_AUTHENTICATOR_MANAGER);//Call HIV    The Eutils.getauthenticator method generates an instance of the corresponding class authenticator.setsessionstate (this); Authorizer = Hiveutils.getauthorizeprovidermanager (conf, HiveConf.ConfVars.HIVE_AUTHORIZATION_MANAGER, Authenticat Or, true);

.....

The Getauthenticator method for Hiveutils is to generate Org.apache.hadoop.hive.ql.security.HadoopDefaultAuthenticator classes with Reflectionutils.newinstance instance, and then invokes the Setconf method of the instance to set the user and group information for hive.

The entire sequence of calls:

Driver.compile--->driver.doauthorization--->sessionstate.isauthorizationmodev2----> Sessiontstate.getauthorizationmode--->sessionstate.setupauth--->hiveutils.getauthenticator+hiveutils--- >hadoopdefaultauthenticator.setconf

It is important to note that:
1) This account controls the permissions of the hive, regardless of the permissions of HDFs, and the two need to distinguish between
2) initialized at the first command, no longer initialized
3) The specific validation operation is done by the authorize of the Hiveauthorizationprovider implementation class

This article is from the "Food and Light Blog" blog, please make sure to keep this source http://caiguangguang.blog.51cto.com/1652935/1587249

Hive Authentication Related class analysis