Hadoop Groups

<property>
<name>hive.sentry.provider</name>
<value>org.apache.sentry.provider.file.HadoopGroupResourceAuthorizationProvider</value>
</property>

Local Groups

1. Define local groups in the [users] section of the Policy File. For example:

   [users]
   user1 = group1, group2, group3
   user2 = group2, group3

2. Modify Sentry configuration as follows:
   In sentry-site.xml, set hive.sentry.provider as follows:

   <property>
   <name>hive.sentry.provider</name>
   <value>org.apache.sentry.provider.file.LocalGroupResourceAuthorizationProvider</value>
   </property>

Prerequisites

•   Important: If you are going to enable HDFS/Sentry synchronization, you do not need to perform the following step to explicitly set permissions for the Hive warehouse directory. With synchronization enabled, all Hive databases and tables will automatically be owned by hive:hive, and Sentry permissions on tables are translated to HDFS ACLs for the underlying table files.
  The Hive warehouse directory (/user/hive/warehouse or any path you specify as hive.metastore.warehouse.dir in your hive-site.xml) must be owned by the Hive user and group.
  • Permissions on the warehouse directory must be set as follows (see following Note for caveats):
    • 771 on the directory itself (for example, /user/hive/warehouse)
    • 771 on all subdirectories (for example, /user/hive/warehouse/mysubdir)
    • All files and subdirectories should be owned by hive:hive
    For example:

    $ sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
    $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

    If you have enabled Kerberos on your cluster, you must kinit as the hdfs user before you set permissions. For example:

    sudo -u hdfs kinit -kt <hdfs.keytab> hdfs
    sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
    $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

      Note:

    • If you set hive.warehouse.subdir.inherit.perms to true in hive-site.xml, the permissions on the subdirectories will be set when you set permissions on the warehouse directory.
    • If a user has access to any object in the warehouse, that user will be able to execute use default. This ensures that use default commands issued by legacy applications work when Sentry is enabled.
    • The instructions described above for modifying permissions on the Hive warehouse directory override the recommendations in the Hive section of the CDH 5 Installation Guide.
• HiveServer2 impersonation must be turned off.
• The Hive user must be able to submit MapReduce jobs. You can ensure that this is true by setting the minimum user ID for job submission to 0. Edit the taskcontroller.cfg file and set min.user.id=0.
  To enable the Hive user to submit YARN jobs, add the user hive to the allowed.system.users configuration property. Edit the container-executor.cfg file and add hive to the allowed.system.users property. For example,

  allowed.system.users = nobody,impala,hive,hbase

    Important:

  • You must restart the cluster and HiveServer2 after changing this value, whether you use Cloudera Manager or not.
  • These instructions override the instructions under Configuring MRv1 Security
  • These instructions override the instructions under Configuring YARN Security
• Add the Hive, Impala, and Hue groups to Sentry's admin groups. If an end user is in one of these admin groups, that user has administrative privileges on the Sentry Server.

  <property>
    <name>sentry.service.admin.group</name>
    <value>hive,impala,hue</value>
   </property>

Configuration Changes Required

<property>
<name>hive.server2.session.hook</name>
<value>org.apache.sentry.binding.hive.HiveAuthzBindingSessionHook</value>
</property>

<property>
<name>hive.sentry.conf.url</name>
<value></value>
<description>sentry-site.xml file location</description>
</property>

<property>
<name>hive.metastore.client.impl</name>
<value>org.apache.sentry.binding.metastore.SentryHiveMetaStoreClient</value>
<description>Sets custom Hive Metastore client which Sentry uses to filter out metadata.</description>
</property>