常用命令
bin/beeline -u jdbc:hive2://bigdata-senior01.ibeifeng.com:10000 -n admin -p admin
创建和删除角色 CREATE ROLE ROLE_NAME
删除角色: DROP ROLE ROLE_NAME
把role_test1角色授权给jayliu用户,命令如下 grant role role_test1 to user jayliu;
查看jayliu用户被授权的角色,命令如下: SHOW ROLE GRANT user jayliu;
取消jayliu用户的role_test1角色,操作命令如下: revoke role role_test1 from user jayliu;
把某个库的所有权限给一个角色,角色给用户!
grant all on database user_lisi to role role_lisi;
grant role role_lisi to user lisi;
把某个库的权限直接给用户!grant ALL ON DATABASE USER_LISI TO USER lisi;
收回 revoke ALLondatabase default from user lisi;
查看用户对数据看的权限 show grant user lisi on database user_lisi;
(1)管理员可以将指定用户加入角色admin;
(2)数据库dataset的所有者为角色admin,只有具有角色admin的用户才可以在此库中完成建表、修改表、删除表等操作;
(3)普通用户无法查看或使用没有权限的数据库、没有权限的表(需要扩展现有的权限机制);
(4)管理员可将数据库dataset中的表(视图)查询权限赋予某个角色或某个用户;
(5)普通用户是自己用户主(从)库的所有者,即拥有库内所有表(视图)的所有权限;
(6)普通用户可以将自己拥有的权限赋予给其它角色或用户。
hive-site.xml 中配置
<property>
<name>javax.jdo.option.ConnectionURL</name>
<value>jdbc:mysql://bigdata-senior01.ibeifeng.com:3306/cdhmetastore?createDatabaseIfNotExist=true</value>
</property>
<property>
<name>javax.jdo.option.ConnectionDriverName</name>
<value>com.mysql.jdbc.Driver</value>
</property>
<property>
<name>javax.jdo.option.ConnectionUserName</name>
<value>root</value>
</property>
<property>
<name>javax.jdo.option.ConnectionPassword</name>
<value>123456</value>
</property>
<property>
<name>hive.cli.print.header</name>
<value>true</value>
</property>
<property>
<name>hive.cli.print.current.db</name>
<value>true</value>
</property>
<property>
<name>hive.metastore.warehouse.dir</name>
<value>/user/hive/warehouse</value>
<description>location of default database for the warehouse</description>
</property>
<!--
<property>
<name>hive.metastore.uris</name>
<value>thrift://hadoop-senior01.ibeifeng.com:9083</value>
<description>Thrift URI for the remote metastore. Used by metastore client to connect to remote metastore.</description>
</property>
-->
<!--权限管理-->
<property>
<name>hive.users.in.admin.role</name>
<value>lisi</value>
<description>定义超级管理员 启动的时候会自动创建Comma separated list of users who are in admin role for bootstrapping.
More users can be added in ADMIN role later.</description>
</property>
<property>
<name>hive.security.authorization.enabled</name>
<value>true</value>
<description>开启权限 enable or disable thehive client authorization</description>
</property>
<property>
<name>hive.security.authorization.createtable.owner.grants</name>
<value>ALL</value>
<description>表的创建者对表拥有所有权限the privileges automaticallygranted to the owner whenever a table gets created. An example like"select,drop" will grant select and drop privilege to the owner ofthe table</description>
</property>
<property>
<name>hive.security.authorization.task.factory</name>
<value>org.apache.hadoop.hive.ql.parse.authorization.HiveAuthorizationTaskFactoryImpl</value>
<description>进行权限控制的配置。</description>
</property>
<property>