Hadoop Groups

Local Groups

  Note: You can use either Hadoop groups or local groups, but not both at the same time. Use local groups if you want to do a quick proof-of-concept. For production, use Hadoop groups.

1. Define local groups in the [users] section of the Policy File. For example:

   [users]
   user1 = group1, group2, group3
   user2 = group2, group3

2. Modify Sentry configuration as follows:
   1. Go to the Hive service.
   2. Click the Configuration tab.
   3. Select Scope > Hive (Service-Wide).
   4. Select Category > Policy File Based Sentry.
   5. Locate the Sentry User to Group Mapping Class property or search for it by typing its name in the Search box.
   6. Set the Sentry User to Group Mapping Class property to org.apache.sentry.provider.file.LocalGroupResourceAuthorizationProvider.
   7. Click Save Changes.
   8. Restart the Hive service.

Minimum Required Role: Configurator (also provided by Cluster Administrator, Full Administrator)

1. See Before You Install Sentry to verify the prerequisites.
2. Setting Hive Warehouse Directory Permissions
     Important: Enabling HDFS/Sentry synchronization obviates the need to explicitly set permissions on the Hive warehouse directory. After synchronization is enabled, all Hive databases and tables are owned by hive:hive and Sentry permissions on tables are automatically translated to HDFS ACLs on the underlying files.
   The Hive warehouse directory (/user/hive/warehouse or any path you specify as hive.metastore.warehouse.dir in your hive-site.xml) must be owned by the Hive user and group (hive:hive).
   • Using the default Hive warehouse directory - Permissions on the warehouse directory must be set as follows (see following Note for caveats):
     • 771 on the directory itself (by default, /user/hive/warehouse)
     • 771 on all subdirectories (for example, /user/hive/warehouse/mysubdir)
     • All files and subdirectories should be owned by hive:hive
     For example:

     $ sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
     $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

     If you have enabled Kerberos on your cluster, you must kinit as the hdfs user before you set permissions. For example:

     sudo -u hdfs kinit -kt hdfs.keytab hdfs
     sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
     $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

   • Using a non-default Hive warehouse: To use a different directory for the Hive warehouse, specify the directory path in the hive.metastore.warehouse.dir property and set the permissions on the new directory, as shown in this example:

     $ hdfs dfs -chown hive:hive /data
     $ hdfs dfs -chmod 771 /data

       Note: Changing the default Hive warehouse to a new location does not move existing tables. Any tables created prior to changing the path remain in the default location, but new tables will be created in the new path.

     For Sentry/HDFS sync to work as expected, add the new warehouse URL to the list of Sentry Synchronization Path Prefixes.

     Note:

   • Set hive.warehouse.subdir.inherit.perms to true in hive-site.xml to have permissions set on the warehouse directory applied to all subdirectories.
   • If a user has access to any object in the warehouse, that user will be able to execute use default. This ensures that use default commands issued by legacy applications work when Sentry is enabled.
   • Modifying permissions on the Hive warehouse directory (as detailed above) override the recommendations in the Hive section of the CDH 5 Installation Guide.
3. Disable impersonation for HiveServer2:
   1. Go to the Hive service.
   2. Click the Configuration tab.
   3. Select Scope > HiveServer2.
   4. Select Category > All.
   5. Locate the HiveServer2 Enable Impersonation property or search for it by typing its name in the Search box.
   6. Under the HiveServer2 role group, clear the HiveServer2 Enable Impersonation property.
   7. Click Save Changes to commit the changes.
4. Create the Sentry policy file, sentry-provider.ini, as an HDFS file.
5. Enable the Hive user to submit MapReduce jobs.
   1. Go to the MapReduce service.
   2. Click the Configuration tab.
   3. Select Scope > TaskTracker.
   4. Select Category > Security.
   5. Locate the Minimum User ID for Job Submission property or search for it by typing its name in the Search box.
   6. Set the Minimum User ID for Job Submission property to 0 (the default is 1000).
   7. Click Save Changes to commit the changes.
   8. Repeat steps 5.a-5.d for every TaskTracker role group for the MapReduce service that is associated with Hive, if more than one exists.
   9. Restart the MapReduce service.
6. Enable the Hive user to submit YARN jobs.
   1. Go to the YARN service.
   2. Click the Configuration tab.
   3. Select Scope > NodeManager.
   4. Select Category > Security.
   5. Ensure the Allowed System Users property includes the hive user. If not, add hive.
   6. Click Save Changes to commit the changes.
   7. Repeat steps 6.a-6.d for every NodeManager role group for the YARN service that is associated with Hive, if more than one exists.
   8. Restart the YARN service.
7. Go to the Hive service.
8. Click the Configuration tab.
9. Select Scope > Hive (Service-Wide).
10. Select Category > Policy File Based Sentry.
11. Select Enable Sentry Authorization Using Policy Files.
12. Click Save Changes to commit the changes.
13. Add the Hive user group to Sentry's admin groups.
    1. Go to the Sentry service.
    2. Click the Configuration tab.
    3. Select Scope > Sentry (Service-Wide).
    4. Select Category > Main.
    5. Locate the Admin Groups property and add the hive group to the list. If an end user is in one of these admin groups, that user has administrative privileges on the Sentry Server.
    6. Click Save Changes to commit the changes.
14. Restart the cluster and HiveServer2 after changing these values, whether you use Cloudera Manager or not.