Security Configuration for Hive

To better use hive, I took out the security section of Programming hive and translated it.

Hive also supports quite a few rights management functions to meet the general Data Warehouse usage.

Hive configures the default permissions for new files by a default setting.

XML code

2. <property>
4. <name>hive.files.umask.value</name>
6. <value>0002</value>
8. <description>the dfs.umask value for the hive created folders</description> /c4>
10. </Property>

<property>  <name>hive.files.umask.value</name>  <value>0002</value>  <description>the Dfs.umask value for the hive created folders</description></property>

When the Hive.metastore.authorization.storage.checks property is set to True,
Hive will prevent a user who does not have permissions from doing a table delete operation.
However, the default value for this configuration is false and should be set to True

XML code

2. <property>
4. <name>hive.metastore.authorization.storage.checks</name>
6. <value>true</value>
8. <description>should The Metastore do authorization checks against
10. The underlying storage for operations like Drop-partition (disallow
12. The drop-partition if the user in question doesn ' t has permissions
14. To delete the corresponding directory on the storage). </Description>
16. </Property>

<property>  <name>hive.metastore.authorization.storage.checks</name>  <value> True</value>  <description>should The Metastore do authorization checks against the  underlying Storage for operations like Drop-partition (disallow the  drop-partition if the user in question doesn ' t has Permissio NS to  delete the corresponding directory on the storage) .</description></property>

At the same time, Hive will set the Hive.metastore.execute.setugi to true as much as possible.

Turn on the identity authentication function of hive, default is False

XML code

2. <property>
4. <name>hive.security.authorization.enabled</name>
6. <value>true</value>
8. <description>enable or disable the Hive client authorization</Description>
10. </Property>

<property>  <name>hive.security.authorization.enabled</name>   <value>true</ value>  <description>enable or disable the hive client Authorization</description></property >

There is also a permission configuration item that is used by the table creator:

XML code

2. <property>
4. <name>hive.security.authorization.createtable.owner.grants</name>
6. <value>all</value>
8. <description>the privileges automatically granted to the owner whenever
10. A table gets created. An example-like "Select,drop" would grant Select
12. and drop privilege to the owner of the table</description>
14. </Property>

<property>  <name>hive.security.authorization.createtable.owner.grants</name>  < Value>all</value>  <description>the privileges automatically granted to the owner whenever  a Table gets created. An example-like "Select,drop" would grant select and drop privilege to the owner of the  table</description></p Roperty>

This configuration is null by default, and we recommend that you set it to all so that users can access the tables that they create.

testing, enabling user authentication on the command line environment

Shell Code

1. Hive> set hive.security.authorization.enabled=true;
2. Hive> CREATE TABLE authorization_test (key int, value string);
3. Authorization failed:no Privilege ' Create ' found for outputs {Database:default}.
4. Use show grant to get more details.

Hive> set hive.security.authorization.enabled=true;hive> CREATE TABLE authorization_test (key int, value string); Authorization failed:no privilege ' Create ' found for outputs {Database:default}. Use show grant to get more details.

As we can see, building the table requires permission.
Permissions can be granted to different topics, such as user, Group, role (ROLES)

Now we grant permissions to the current user through authorization:

Shell Code

1. Hive> set System:user.name;
2. System:user.name=edward
3. Hive> GRANT CREATE on DATABASE default to USER Edward;
4. Hive> CREATE TABLE authorization_test (key INT, value STRING);

Hive> set system:user.name;system:user.name=edwardhive> GRANT CREATE on DATABASE default to user edward;hive> CR Eate TABLE authorization_test (key INT, value STRING);

This makes it possible to create a table.

We can confirm the permissions we have with the show Grant command:

Shell Code

1. hive> SHOW GRANT USER Edward on DATABASE default;
2. Database default
3. PrincipalName Edward
4. Principaltype USER
5. Privilege Create
6. Granttime Mon Mar ::EDT
7. Grantor Edward

hive> SHOW GRANT USER Edward on DATABASE default;database defaultprincipalname edwardprincipaltype userprivilege Creat Egranttime Mon Mar 09:18:10 EDT 2012grantor Edward

When hive is used for n multiple users and N tables, the administrator authorizes each user to crash each table.
Therefore, the group authorization can be performed at this time.
The definition of a user group in hive is equivalent to a user group within POSIX.

Shell Code

1. Hive> create table authorization_test_group (a int,b int );   
2. hive> select * from authorization_test_group;   
3. Authorization failed:no privilege  ' Select '  found for inputs   
4. { database:default, table:authorization_test_group, columnname:a}.   
5. use show grant to get more details.   
6. hive> grant select on table authorization_test_group to group  Edward   
7. hive> select * from authorization_test_group;   
8. OK   
9. time taken: 0.119&NBSP;SECONDS&NBSP;&NBSP;

Hive> CREATE TABLE authorization_test_group (a int,b int);hive> SELECT * from Authorization_test_group; Authorization failed:no privilege ' Select ' found for inputs{Database:default, Table:authorization_test_group, COLUMNNAME:A}.  Use show grant to get more details.hive> grant SELECT on table Authorization_test_group to group edward;hive> SELECT * FROM Authorization_test_group;oktime taken:0.119 seconds

Roles (ROLES) are used when authorization to user groups becomes inflexible.
The user can be placed in a role, and the role can be authorized.
Roles are different from user groups and are controlled by Hadoop and are managed internally by Hive.

Shell Code

2. Hive> CREATE TABLE authentication_test_role (a int, b int);
4. Hive> SELECT * from Authentication_test_role;
6. Authorization failed:no Privilege ' Select ' found for inputs
8. {database:default, Table:authentication_test_role, columnname:a}.
10. Use show grant to get more details.
12. hive> CREATE ROLE Users_who_can_select_authentication_test_role;
14. Hive> GRANT ROLE users_who_can_select_authentication_test_role to USER Edward;
16. Hive> GRANT SELECT on TABLE authentication_test_role
18. > to ROLE users_who_can_select_authentication_test_role;
20. Hive> SELECT * from Authentication_test_role;
22. Ok
24. Time taken: 0.103 seconds

Hive> CREATE TABLE authentication_test_role (a int, b int);hive> SELECT * from Authentication_test_role; Authorization failed:no privilege ' Select ' found for inputs{Database:default, Table:authentication_test_role, COLUMNNAME:A}.  Use show grant to get more details.hive> CREATE role users_who_can_select_authentication_test_role;hive> Grant role Users_who_can_select_authentication_test_role to USER edward;hive> GRANT Select on TABLE authentication_test_role > To ROLE users_who_can_select_authentication_test_role;hive> select * from Authentication_test_role;oktime taken:0.103 seconds

Introduce the commonly used authorization keywords:

Alter	Change table structure, create partitions
CREATE	Create a table
DROP	Delete a table, or partition
INDEX	Creating and deleting indexes
LOCK	Lock the table to ensure concurrency
SELECT	Query table Permissions
Show_database	View Database Permissions
UPDATE	Permissions to load local data for a table

Partition Table-Level authorization
By default, the authorization of the partitioned table will follow the table's authorization
Of course, you can also create an authorization mechanism for each partition,
Just set the properties of the table Partition_level_privilege set to True:

Shell Code

1. hive> ALTER TABLE Authorization_part
2. > SET tblproperties ("partition_level_privilege" ="TRUE");
3. Authorization failed:no Privilege ' Alter ' found for inputs
4. {Database:default, Table:authorization_part}.
5. Use show grant to get more details.

hive> ALTER TABLE authorization_part> SET tblproperties ("partition_level_privilege" = "TRUE"); Authorization failed:no privilege ' Alter ' found for Inputs{database:default, Table:authorization_part}. Use show grant to get more details.

Automatic authorization
The attribute hive.security.authorization.createtable.owner.grants determines
The table owner has permissions to the table, and in the case of a version, select and drop

XML code

1. <property>
2. <name>hive.security.authorization.createtable.owner.grants</name>
3. <value>select,drop</value>
4. </Property>

<property>  <name>hive.security.authorization.createtable.owner.grants</name>  < Value>select,drop</value></property>

Similarly, a particular user can be granted permissions automatically when the table is created.

XML code

1. <property>  
2.   <name >hive.security.authorization.createtable.user.grants</name>  
3.    <value>admin1,edward:select;user1:create</ value>  
4. </property>  

<property>  <name>hive.security.authorization.createtable.user.grants</name>  < Value>admin1,edward:select;user1:create</value></property>

When the table was established, Administrator Admin1 and user Edward granted permission to read all the tables.
Instead, User1 can only create tables.

The same configuration can also be used for group authorization and role authorization
Hive.security.authorization.createtable.group.grants
Hive.security.authorization.createtable.role.grants

Transfer from http://dacoolbaby.iteye.com/blog/1829545

Security Configuration for Hive