Cloudera Hive传统权限管理设置

step1:
添加jar包至
生产hive客户端路径/user/lib/hive
生产hive服务器路径/opt/cloudera/parcels/CDH/lib/hive/
step2:
admin用户配置CM中hive组件中hive-site参数
<1> Hive Service Advanced Configuration Snippet (Safety Valve) for hive-site.xml

        name:hive.security.authorization.enabled    value:true

        name:hive.security.authorization.createtable.owner.grants   value:ALL

        name:hive.security.authorization.task.factory value:org.apache.hadoop.hive.ql.parse.authorization.HiveAuthorizationTaskFactoryImpl

        name:hive.warehouse.subdir.inherit.perms    value:true

        name:hive.semantic.analyzer.hook    vlaue:cn.jpush.HiveAdmin

        name:hive.metastore.authorization.storage.checks    value:true

    <2> Hive Client Advanced Configuration Snippet (Safety Valve) for hive-site.xml
        name:hive.security.authorization.enabled    value:true

        name:hive.security.authorization.createtable.owner.grants   value:ALL

        name:hive.security.authorization.task.factory value:org.apache.hadoop.hive.ql.parse.authorization.HiveAuthorizationTaskFactoryImpl

        name:hive.warehouse.subdir.inherit.perms    value:true

        name:hive.semantic.analyzer.hook    vlaue:cn.jpush.HiveAdmin

        name:hive.metastore.authorization.storage.checks    value:true


    <4> HiveServer2 Advanced Configuration Snippet (Safety Valve) for hive-site.xml
        name:hive.semantic.analyzer.hook    value:cn.jpush.HiveAdmin

– Step3:
– <3.0>修改集群2台namenode服务器文件 /etc/group，为所有用户（除ronghui）添加到data组中。

– <3.1>为date组用户添加kaikai库的rwx权限
– hdfs dfs -setfacl -m group:data:rwx /user/hive/warehouse/kaikai.db
– (删除目前对partner组限定的facl权限，775权限，虽然其他组成员在hdfs有读权限，但是没有写入权限，同时grant方式禁止partner组读取data组的库数据。)
– hdfs dfs -setfacl -b /user/hive/warehouse/sed.db

– <3.2>切换hdfs用户修改/user/warehouse目录下的文件，都改为push用户:data组，包含warehouse文件夹。
– 便于以后有了调度系统，直接删除data组的大部分用户，使用push用户上线，将文件都改为755权限更安全。
– (/user/hive/external已经是push:data，所以不用管。)
– hdfs dfs -chown -R push:data /user/hive/warehouse
– hdfs dfs -chown -R push:data /user/hive/external
– 之后的管理员才能建立的新数据库。因为hive默认是warehouse是hive:hive的user:group关系。

– hdfs dfs -chown -R push:data /user/hive/warehouse/tmp.db

– <3.3>继续使用hdfs用户修改权限为775。
– hdfs dfs -chmod -R 775 /user/hive/warehouse/ads.db

Step4：开始修改hive元数据。
hive -f grant_order.hql

PS：可以在Hive元数据中查看ROLES，DBS,DB_PRIVS,GLOBAL_PRIVS，ROLE_MAP表看以上赋权命令对应的数据记录信息

HiveAdmin class代码

package cn.jpush;

/**
 * Created by wmky_kk on 2017-06-01.
 * add test
 */

import org.apache.hadoop.hive.ql.parse.*;
import org.apache.hadoop.hive.ql.session.SessionState;

public class HiveAdmin extends AbstractSemanticAnalyzerHook {
//    private static String admin = "youck";
    private static String[] admin = {"youck","root"};
    @Override
    public ASTNode preAnalyze(HiveSemanticAnalyzerHookContext context, ASTNode ast)throws SemanticException {
        switch(ast.getToken().getType()) {
            //  shows how a statement can have multiple case labels
            case HiveParser.TOK_CREATEDATABASE:
            case HiveParser.TOK_DROPDATABASE:
            case HiveParser.TOK_CREATEROLE:
            case HiveParser.TOK_DROPROLE:
            case HiveParser.TOK_GRANT:
            case HiveParser.TOK_REVOKE:
            case HiveParser.TOK_GRANT_ROLE:
            case HiveParser.TOK_REVOKE_ROLE:
                String userName = null;
                if(SessionState.get() != null
                        &&SessionState.get().getAuthenticator()!= null){
                    userName=SessionState.get().getAuthenticator().getUserName();
                }
                    if (!(admin[0].equalsIgnoreCase(userName)||admin[1].equalsIgnoreCase(userName)||
                            admin[2].equalsIgnoreCase(userName)||admin[3].equalsIgnoreCase(userName))) {
                        throw new SemanticException(userName + " can't use ADMIN options,except " + "\"youck\",\"root\",\"xujun\",\"huangyq\"" + ".");
                    }
                break;
            default:
                break;
        }
        return ast;
    }

/*    public static void main(String[] args) throws SemanticException {
        String[] admin = { "admin","root" };
        String userName = "root";
        for (String tmp : admin) {
//            System.out.println(tmp);
            if (!tmp.equalsIgnoreCase(userName)) {
//                System.out.print(userName+ " can't use ADMIN options, except " + admin[0] + "," + admin[1] + ".");
                throw new SemanticException(userName
                        + " can't use ADMIN options, except " + admin[0] + ","
                        + admin[1] + ".");
            }
        }
    }*/
}