近期,总给其他部门的人开数据表权限,如果单独给每一个用户开权限,有点杂乱也不太好管理,所以抽空理了一下hive数据表权限相关的知识点。
目录
参数配置
在使用Hive的元数据配置权限之前必须先在hive-site.xml中配置两个参数,配置参数如下:
<property>
<!--开启权限验证,默认为false>
<name>hive.security.authorization.enabled</name>
<value>true</value>
</property>
<property>
<!--指表的创建者对表拥有所有权限>
<name>hive.security.authorization.createtable.owner.grants</name>
<value>ALL</value>
</property>
|
角色创建删除
1.创建角色:create role role_name;
2.删除角色:drop role role_name;
3.展示所有roles:show roles;
4.将角色授权给用户:grant role {roleName} to user {userName};
5.撤销用户的角色:revoke role {roleName} from user {userName};
6.查看用户所属的角色:show role grant user {userName};
授权及回收角色权限
注:授权用户(user)和角色(role)语法是一样的,将下面user换成role,userName 换成 roleName即可。
1.授予某个库(表)的某个权限给某个用户
语法:grant {authority_name} on database {dbName} to user {userName};
grant {authority_name} on table {dbName}.{tableName} to user {userName};
例:grant {select} on database {dbName} to user {userName};
grant {insert} on database {dbName} to user {userName};
grant {update} on database {dbName} to user {userName};
grant {delete} on database {dbName} to user {userName};
grant create on database {dbName} to user {userName};//授予某个用户在某个库下的建表权限
grant select on table {dbName}.{tableName} to user {userName};
grant insert on table {dbName}.{tableName} to user {userName};
grant update on table {dbName}.{tableName} to user {userName};
grant delete on table {dbName}.{tableName} to user {userName};
2.回收某个用户的某个库(表)的某个权限
语法:revoke {authority_name} on database {dbName} from user {userName};
revoke {authority_name} on table {dbName}.{tableName} from user {userName};
例:revoke {select} on database {dbName} from user {userName};
revoke {insert} on database {dbName} from user {userName};
revoke {update} on database {dbName} from user {userName};
revoke {delete} on database {dbName} from user {userName};
revoke create on table {dbName}.{tableName} from user {userName};
revoke select on table {dbName}.{tableName} from user {userName};
revoke insert on table {dbName}.{tableName} from user {userName};
revoke update on table {dbName}.{tableName} from user {userName};
revoke delete on table {dbName}.{tableName} from user {userName};
展示权限
1.查看指定用户在所有库下面的权限:show grant user {username};
2.查看指定用户在某个库下面的权限:show grant user {username} on database {dbName};
3.查看指定用户在指定表的权限:show grant user {userName} on table {dbName}.{tableName};
4.查看拥有某个表权限的所有用户:show grant on table {table_name};
5.查看用户所属的角色:show role grant user {userName};
用户可以从hive中获得的权限
权限名称
|
含义
|
ALL
|
所有权限
|
ALTER
|
允许修改元数据(modify metadata data of object) —表数据信息
|
UPDATE
|
允许修改物理数据(modify physical data object) —实际数据
|
CREATE
|
允许进行CREATE 操作
|
DROP
|
允许进行DROP操作
|
INDEX
|
允许建索引(目前还没实现)
|
LOCK
|
当出现并发时使用允许用户进行LOCK和UNLOCK操作
|
SELECT
|
允许用户进行SELECT操作
|
SHOW DATABASE
|
允许用户查看可用的数据库
|