Before Enabling the Sentry Service

• Verify the prerequisites for the Sentry service: Before You Install Sentry
• Setting Hive Warehouse Directory Permissions
    Important: Enabling HDFS/Sentry synchronization obviates the need to explicitly set permissions on the Hive warehouse directory. After synchronization is enabled, all Hive databases and tables are owned by hive:hive and Sentry permissions on tables are automatically translated to HDFS ACLs on the underlying files.
  The Hive warehouse directory (/user/hive/warehouse or any path you specify as hive.metastore.warehouse.dir in your hive-site.xml) must be owned by the Hive user and group (hive:hive).
  • Using the default Hive warehouse directory - Permissions on the warehouse directory must be set as follows (see following Note for caveats):
    • 771 on the directory itself (by default, /user/hive/warehouse)
    • 771 on all subdirectories (for example, /user/hive/warehouse/mysubdir)
    • All files and subdirectories should be owned by hive:hive
    For example:

    $ sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
    $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

    If you have enabled Kerberos on your cluster, you must kinit as the hdfs user before you set permissions. For example:

    sudo -u hdfs kinit -kt hdfs.keytab hdfs
    sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
    $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

  • Using a non-default Hive warehouse: To use a different directory for the Hive warehouse, specify the directory path in the hive.metastore.warehouse.dir property and set the permissions on the new directory, as shown in this example:

    $ hdfs dfs -chown hive:hive /data
    $ hdfs dfs -chmod 771 /data

      Note: Changing the default Hive warehouse to a new location does not move existing tables. Any tables created prior to changing the path remain in the default location, but new tables will be created in the new path.

    For Sentry/HDFS sync to work as expected, add the new warehouse URL to the list of Sentry Synchronization Path Prefixes.

    Note:

  • Set hive.warehouse.subdir.inherit.perms to true in hive-site.xml to have permissions set on the warehouse directory applied to all subdirectories.
  • If a user has access to any object in the warehouse, that user will be able to execute use default. This ensures that use default commands issued by legacy applications work when Sentry is enabled.
  • Modifying permissions on the Hive warehouse directory (as detailed above) override the recommendations in the Hive section of the CDH 5 Installation Guide.
• Disable impersonation for HiveServer2 in the Cloudera Manager Admin Console. HiveServer2 impersonation lets users execute queries and access HDFS files as the connected user rather than as the super user. Access policies are applied at the file level using the HDFS permissions specified in ACLs (access control lists). Enabling HiveServer2 impersonation bypasses Sentry from the end-to-end authorization process. Specifically, although Sentry enforces access control policies on tables and views within the Hive warehouse, it does not control access to the HDFS files that underlie the tables. This means that users without Sentry permissions to tables in the warehouse may nonetheless be able to bypass Sentry authorization checks and execute jobs and queries against tables in the warehouse as long as they have permissions on the HDFS files supporting the table. Use the following instructions to disable impersonation:
  1. Go to the Hive service.
  2. Click the Configuration tab.
  3. Select Scope > HiveServer2.
  4. Select Category > Main.
  5. Uncheck the HiveServer2 Enable Impersonation checkbox.
  6. Click Save Changes to commit the changes.
• If you are using MapReduce, enable the Hive user to submit MapReduce jobs.
  1. Open the Cloudera Manager Admin Console and go to the MapReduce service.
  2. Click the Configuration tab.
  3. Select Scope > TaskTracker.
  4. Select Category > Security.
  5. Set the Minimum User ID for Job Submission property to zero (the default is 1000).
  6. Click Save Changes to commit the changes.
  7. Repeat steps 1-6 for every TaskTracker role group for the MapReduce service that is associated with Hive.
  8. Restart the MapReduce service.
• If you are using YARN, enable the Hive user to submit YARN jobs.
  1. Open the Cloudera Manager Admin Console and go to the YARN service.
  2. Click the Configuration tab.
  3. Select Scope > NodeManager.
  4. Select Category > Security.
  5. Ensure the Allowed System Users property includes the hive user. If not, add hive.
  6. Click Save Changes to commit the changes.
  7. Repeat steps 1-6 for every NodeManager role group for the YARN service that is associated with Hive.
  8. Restart the YARN service.

• Block the Hive CLI user from accessing the Hive metastore:

  1. In the Cloudera Manager Admin Console, select the Hive service.
  2. On the Hive service page, click the Configuration tab.
  3. In the search field, search for Hive Metastore Access Control and Proxy User Groups Override to locate the hadoop.proxyuser.hive.groups setting.
  4. Click the plus sign three times to add the following groups:
     • hive
     • hue
     • sentry
  5. Click Save Changes.

  Setting this parameter blocks access to the Hive metastore for the user running the Hive CLI if they are not part of the hive, hue, or sentry groups. The Hive CLI can still run, but after setting this parameter as described here, the hive user can impersonate only members of the hive, sentry, or hue groups. If you are using Sqoop, the Sqoop user must also have access to the Hive metastore.

  Important: Ensure you have unchecked the Enable Sentry Authorization using Policy Files configuration property for both Hive and Impala under the Policy File Based Sentry category before you proceed.

Enabling the Sentry Service for Hive

1. Go to the Hive service.
2. Click the Configuration tab.
3. Select Scope > Hive (Service-Wide).
4. Select Category > Main.
5. Locate the Sentry Service property and select Sentry.
6. Locate the Enable Stored Notifications in Database property and select it.
7. Click Save Changes to commit the changes.
8. Restart the Hive service.

Enabling the Sentry Service for Impala

1. Enable the Sentry service for Hive (as instructed above).
2. Go to the Impala service.
3. Click the Configuration tab.
4. Select Scope > Impala (Service-Wide).
5. Select Category > Main.
6. Locate the Sentry Service property and select Sentry.
7. Click Save Changes to commit the changes.
8. Restart Impala.

Enabling the Sentry Service for Solr

1. Go to the Solr service.
2. Click the Configuration tab.
3. Select Scope > Solr (Service-Wide).
4. Select Category > Main.
5. Locate the Sentry Service property and select Sentry.
6. Click Save Changes to commit the changes.
7. Restart Solr.

After enabling Sentry for Solr, you may want to configure authorization as described in Configuring Sentry Authorization for Cloudera Search.

Enabling the Sentry Service for Hue

Hue uses a Security app to make it easier to interact with Sentry. When you set up Hue to manage Sentry permissions, make sure that users and groups are set up correctly. Every Hue user connecting to Sentry must have an equivalent OS-level user account on all hosts so that Sentry can authenticate Hue users. Each OS-level user should also be part of an OS-level group with the same name as the corresponding user's group in Hue.

For more information on using the Security app, see the related blog post.

1. Enable the Sentry service for Hive and Impala (as instructed above).
2. Go to the Hue service.
3. Click the Configuration tab.
4. Select Scope > Hue (Service-Wide).
5. Select Category > Main.
6. Locate the Sentry Service property and select Sentry.
7. Click Save Changes to commit the changes.
8. Restart Hue.

Add the Hive, Impala, Spark, and Hue Groups to Sentry's Admin Groups

Add the user groups that need administrative privileges on the Sentry Server.

1. Go to the Sentry service.
2. Click the Configuration tab.
3. Select Scope > Sentry (Service-Wide).
4. Select Category > Main.
5. Locate the Admin Groups property and add the hive, impala, spark, and hue groups to the list. If an end user is in one of these admin groups, that user has administrative privileges on the Sentry Server.
6. Click Save Changes to commit the changes.