HIVE permission control and super administrator implementation

Manage Hive user rights

From the remote Hive deployment and mysql metadata table dictionary, it is clear that Hive manages user permissions through information stored in metadata. The focus now is on how Hive manages user permissions. Mysql > create user; mysql > create user; mysql > create user; Before answering this question, learn about the Permission management mechanism of Hive.

Hive user groups and users Are Linux user groups and users. Like Hadoop, Hive does not provide user group and user management but only permission control.

1. Configure hive-site. XML

<property> <name>hive.users.in.admin.role</name> <value>root</value> <description> Defines that the super administrator will automatically create Comma Separated List when started  of users who arein admin role for bootstrapping.
More users can be added in ADMIN role later.</description>
</property>
<property>
<name>hive.metastore.authorization.storage.checks</name>
<value>true</value>
</property>
<property>
<name>hive.metastore.execute.setugi</name>
<value>false</value>
</property>
<property>
<name>hive.security.authorization.enabled</name>
<value>true</value> <description> Enable permissionenable or disablethehive client authorization</description> </property> <property> < name > hive. Security. Authorization. Createtable. Owner. The grants < / name > < value > ALL < value > / < description > table creators have ALL permissions to the the table privileges automaticallygranted to the owner whenever a table gets created. An example like"select,drop"will grant select and drop privilege to the owner ofthe table</description> </property> <property> <name>hive.security.authorization.task.factory</name> < value > org. Apache. Hadoop. Hive. Ql. Parse. Authorization. HiveAuthorizationTaskFactoryImpl < value > / < description > configuration for access control. </description> </property> <property> <name>hive.semantic.analyzer.hook</name> <value>com.hive.HiveAdmin</value> <description> Use the hook program to identify the super administrator for authorization control. </description> </property> <property> <name>hive.users.in.admin.role</name> <value>root</value> <description> The specified user is the admin role, multiple users use Comma separated list of users who arein admin role for bootstrapping.
More users can be added in ADMIN role later.</description>
</property>
Copy the code

1. Customize Hive permission management

The Hive administrator must be root, admin, and Hive.

package com.hive; import org.apache.hadoop.hive.ql.parse.ASTNode; import org.apache.hadoop.hive.ql.parse.AbstractSemanticAnalyzerHook; import org.apache.hadoop.hive.ql.parse.HiveParser; import org.apache.hadoop.hive.ql.parse.HiveSemanticAnalyzerHookContext; import org.apache.hadoop.hive.ql.parse.SemanticException; import org.apache.hadoop.hive.ql.session.SessionState; import org.apache.hadoop.hive.ql.security; /** ** Created by Ganymede on 2016/10/4. Ordinary users cannot authorized, library building, built table operations such as * * / public class HiveAdmin extends AbstractSemanticAnalyzerHook {private static String [] admin = {"root"."hadoop"."hive"}; / / configuration Hive administrator @ Override public ASTNode preAnalyze (HiveSemanticAnalyzerHookContext context, ASTNode ast) throws SemanticException { switch (ast.getToken().getType()) {case HiveParser.TOK_CREATEDATABASE:
            case HiveParser.TOK_DROPDATABASE:
            case HiveParser.TOK_CREATEROLE:
            case HiveParser.TOK_DROPROLE:
            case HiveParser.TOK_GRANT:
            case HiveParser.TOK_REVOKE:
            case HiveParser.TOK_GRANT_ROLE:
            case HiveParser.TOK_REVOKE_ROLE:
            case HiveParser.TOK_CREATETABLE:
                String userName = null;
                if(SessionState.get() ! = null && SessionState.get().getAuthenticator() ! = null) { userName = SessionState.get().getAuthenticator().getUserName(); }if(! admin[0].equalsIgnoreCase(userName) && ! admin[1].equalsIgnoreCase(userName) && ! admin[2].equalsIgnoreCase(userName)) { throw new SemanticException(userName +" can't use ADMIN options, except " + admin[0] + "," + admin[1] + ","
                            + admin[2] + ".");
                }
                break;
            default:
                break;
        }
        return ast;
    }


    public static void main(String[] args) throws SemanticException {
        String[] admin = {"admin"."root"};
        String userName = "root1";
        for (String tmp : admin) {
            System.out.println(tmp);
            if(! admin[0].equalsIgnoreCase(userName) && ! admin[1].equalsIgnoreCase(userName)) { throw new SemanticException(userName +" can't use ADMIN options, except " + admin[0] + ","
                        + admin[1] + "."); }}}}Copy the code

2. Package and upload hive files related to JAR configurations

The environment needs to be prepared before packaging. I packaged it directly on the server

Start by placing the jar packages you rely on in the above code in the $HADOOP_HOME/lib folder

Cp/home/hadoop/hadoop3.1 / share/hadoop/common/hadoop - common - 3.0.2. Jar/home/hive/hive3.1 / libCopy the code

Start packing

javac -Djava.ext.dirs="/ home/hive/hive3.1 / lib" HiveAdmin.java -d .
jar cf hive-admin.jar com
Copy the hive-admin.jar package to libCp hive - admin. Jar/home/hive/hive3.1 / libCopy the code

3. Restart hive services

hive --service metastore > metastore.log 2>&1 &
hive --service hiveserver2 > hiveserver2.log 2>&1 &
Copy the code

Here are some commands for assigning permissions:

A user can have multiple user groups. The SET ROLE command will switch the current user to the specified ROLE group.setrole ADMIN; Create role role_name; drop role role_name; Grant select on database zfs_test to role zfs_role; grant select on database zfs_test to role zfs_role; grant select on [table] employee to role user1_1; Show grant role role_name on database db_name; show grant role role_name on [table] t_name; Grant role role_name to user user_name revoke SELECT ON database db_name from role role_name; revoke select on [table] t_name from role role_name; Show role grant user user_name; Show role grant user user1_1; Show grant -- Show grant -- Show grant role zfs_role; CREATE ROLE ROLE_NAME Delete a ROLE: DROP ROLE ROLE_NAME Grant ROLE role_test1 to user jayliu. To view the authorized ROLE of user jayliu, run the SHOW ROLE GRANT user jayliu command. To cancel the role_test1 role of user jayliu, run the following command: revoke role role_test1 from user jayliu; Give all permissions on a library to a role, and the role to the user! grant all on database user_lisi to role role_lisi; grant role role_lisi to user lisi; Give permission to a library directly to the user! grant ALL ON DATABASE USER_LISI TO USER lisi; Revoke ALLondatabase default from user lisi; Show grant user lisi on database user_lisi;Copy the code

HIVE supports the following permissions:

Permission to name	meaning
ALL	All permissions
ALTER	Allows you to modify metadata data of object – table information data
UPDATE	Allows to modify physical data of object – actual data
CREATE	The Create operation is allowed
DROP	The DROP operation is allowed
INDEX	Allows index building (not yet implemented)
LOCK	LOCK and UNLOCK operations are allowed when concurrent use occurs
SELECT	Allows users to perform SELECT operations
SHOW_DATABASE	Allows users to view available databases

View permissions:

SHOW GRANT principal_specification [ON object_type priv_level [(column_list)]]

Relationship between HIVE operations and permissions

As of the release of Hive 0.7, only these operations require permissions, according to org.apache.hadoop.hive.ql.plan.HiveOperation:

Operation	ALTER	UPDATE	CREATE	DROP	LOCK	SELECT	SHOW_DATABASE
LOAD		Square root
EXPORT						Square root
IMPORT	Square root	Square root
CREATE TABLE			Square root
CREATE TABLE AS SELECT		Square root				Square root
DROP TABLE				Square root
SELECT						Square root
ALTER TABLE ADD COLUMN	Square root
ALTER TABLE REPLACE COLUMN	Square root
ALTER TABLE RENAME	Square root
ALTER TABLE ADD PARTITION			Square root
ALTER TABLE DROP PARTITION				Square root
ALTER TABLE ARCHIVE		Square root
ALTER TABLE UNARCHIVE		Square root
ALTER TABLE SET PROPERTIES	Square root
ALTER TABLE SET SERDE	Square root
ALTER TABLE SET SERDEPROPERTIES	Square root
ALTER TABLE CLUSTER BY	Square root
ALTER TABLE PROTECT MODE	Square root
ALTER PARTITION PROTECT MODE	Square root
ALTER TABLE SET FILEFORMAT	Square root
ALTER TABLE SET LOCATION		Square root
ALTER PARTITION SET LOCATION		Square root
ALTER TABLE CONCATENATE		Square root
ALTER PARTITION CONCATENATE		Square root
SHOW DATABASE							Square root
LOCK TABLE					Square root
UNLOCK TABLE					Square root

Automatically authorize

Attribute hive. Security. Authorization. Createtable. Owner. The grants

The permissions that the builder has on a table, including select and drop in the case of a version

<property>  
  <name>hive.security.authorization.createtable.owner.grants</name>  
  <value>select,drop</value>  
</property>  
Copy the code

Similarly, specific users can be granted privileges automatically when a table is created.

<property> <name>hive.security.authorization.createtable.user.grants</name> <value>admin,hive:select; user1:create</value> </property>Copy the code

When the table is created, administrator Admin1 and user Edward grant permission to read all tables.

User1 can only create tables.

The same configuration applies to group authorization and role authorization

hive.security.authorization.createtable.group.grants
hive.security.authorization.createtable.role.grants
Copy the code