Enabling Permission Applications

During script execution and job testing in DataArts Factory, the data source uses the account of the data connection for authentication. Therefore, user permission management enabled through roles or permission sets does not take effect for data development.

After permission applications are configured, data sources no longer use the accounts of the data connections during script execution and job tests in DataArts Factory of DataArts Studio. Instead, the current user identity is used for authentication. In this way, different users have different data permissions, and the centralized management of roles and permissions takes effect.

The impact of permission applications on the execution of scripts and jobs in DataArts Factory is as follows:

If permission applications are disabled, the account of the data connection is used for authentication and authorization during script execution and job tests and scheduling in DataArts Factory.
If permission applications are enabled, the current user is used for authentication and authorization during script execution and job tests in DataArts Factory, and the account of the data connection is used for authentication and authorization during scheduling.

Prerequisites

Proxy permissions have been configured for the users of an MRS Hive connection and MRS Spark connection. For details, see Reference: Configuring Proxy Permissions for MRS Data Connection Users.
The Spark2x component corresponding to the MRS Spark connection uses the multi-active instance mode. Otherwise, change the mode to the multi-active instance mode by referring to Configuring the Switchover Between the Multi-active Instance Mode and the Multi-tenant Mode.
Required data permissions have been configured for the user who uses the data source to prevent service interruptions due to insufficient data permissions after permission applications are enabled. For details about how to configure permissions, see Configuring Permission Sets or Configuring Roles.
Before testing the connectivity of a DWS connection, you have switched the current login account to an IAM sub-user.

Constraints

Permission applications support only GaussDB(DWS) and MRS Hive and MRS Spark in proxy mode.
During the connectivity test, the system uses the current user account to access the data source to ensure that the current user can access the data source. DWS data sources cannot be accessed using a a Huawei account. Therefore, if you log in using a a Huawei account, the connectivity test will fail. Before testing the connectivity of a DWS connection, you need to switch the current login account to an IAM sub-user.
Permission applications are supported only when the version of the CDM cluster selected for the agent in the data connection is 2.10.0.300 or later.
Permission applications are supported only when the guest_agent version of a GaussDB(DWS) cluster is 8.2.1, or later than 8.2.1 and earlier than 9.0.0. For details about how to check the guest_agent version of a GaussDB(DWS) cluster, see Viewing the guest_agent Version of a GaussDB(DWS) Cluster.
Permission applications are supported only when proxy permissions are configured for the users of MRS Hive and MRS Spark data connections.
Permission applications are supported only when the Spark 2x component corresponding to the MRS Spark data connection uses the multi-active instance mode. For details about how to change the mode to the multi-active instance mode, see Configuring the Switchover Between the Multi-active Instance Mode and the Multi-tenant Mode.
User permissions configured in a role/permission set take effect only after the role/permission set is successfully synchronized and the permission application is enabled.

Enabling Permission Applications

On the DataArts Studio console, locate an instance and click Access. On the displayed page, locate a workspace and click DataArts Security.

Figure 1 DataArts Security
In the left navigation pane, choose Permissions Applications.
On the Permissions Applications page, test the connectivity of the data connections for which you want to enable permission applications. During the connectivity test, the system uses the current user account to access the data source to ensure that the current user can access the data source.

DWS data sources cannot be accessed using a a Huawei account. Therefore, if you log in using a a Huawei account, the connectivity test will fail. Before testing the connectivity of a DWS connection, you need to switch the current login account to an IAM sub-user.

Figure 2 Testing connectivity

If the connectivity is abnormal, perform the following checks:
1. Check whether the data source connected by the data connection is available.
2. Check whether the version of the CDM cluster selected as the agent for the data connection is 2.10.0.300 or later.
3. Check whether the guest_agent version of the GaussDB(DWS) cluster connected by the data connection is 8.2.1 or later than 8.2.1 and earlier than 9.0.0. For details about how to check the guest_agent version of a GaussDB(DWS) cluster, see Viewing the guest_agent Version of a GaussDB(DWS) Cluster.
4. Check whether a proxy has been configured for the user of the MRS Hive or MRS Spark connection. If no proxy has been configured, see Reference: Configuring Proxy Permissions for MRS Data Connection Users.
5. Check whether the Spark 2x component corresponding to the MRS Spark data connection uses the multi-active instance mode. Permission applications are supported only in multi-active instance mode. For details about how to change the mode to the multi-active instance mode, see Configuring the Switchover Between the Multi-active Instance Mode and the Multi-tenant Mode.
After the connectivity test is successful, click to enable permission applications and then click OK.

Reference: Configuring Proxy Permissions for MRS Data Connection Users

By default, when you access a data source through an MRS Hive or Spark data connection on DataArts Studio, the account configured in the data connection is used by default. If you configure Hive or Spark proxy permissions for the account in the MRS Hive or Spark data connection, you can use your own identity to perform this operation and enable permission applications. For details, see Configuring Hive proxy permissions and Configuring Spark proxy permissions.

Configuring Hive proxy permissions

Choose Cluster > Services > Hive and click Configurations and then Basic Configurations. In the search box, enter core.site.customized.configs and set the parameter listed in Figure 3.

**Table 1** Parameter
Parameter	Name	Value
core.site.customized.configs	hadoop.proxyuser.Username configured for the data connection.users	*
	hadoop.proxyuser.Username configured for the data connection.groups	*
	hadoop.proxyuser.Username configured for the data connection.hosts	*

Figure 3 Configuring the core.site.customized.configs parameter

After setting the parameter, click Save in the upper left corner and then OK in the dialog box to save the configuration.

Figure 4 Saving the configuration
After saving the configuration, switch to the Instances tab page, select the instance that has expired, click More, and select Instance Rolling Restart to make the configuration take effect.

Figure 5 Performing a rolling instance restart

Configuring Spark proxy permissions

Choose Cluster > Services > Spark and click Configurations and then Basic Configurations or choose Cluster > Services > Spark2x and click Configurations and then Basic Configurations. In the search box, enter spark.core-site.customized.configs and set the parameter listed in Figure 6. The Spark component is used as an example.

**Table 2** Parameter
Parameter		Name	Value
Spark->JDBCServer Or Spark2x->JDBCServer2x	core.site.customized.configs	hadoop.proxyuser.Username configured for the data connection.groups	*
		hadoop.proxyuser.Username configured for the data connection.hosts	*
		hadoop.proxyuser.Username configured for the data connection.groups	*
		hadoop.proxyuser.Username configured for the data connection.hosts	*

Figure 6 Configuring the spark.core-site.customized.configs parameter

After setting the parameter, click Save in the upper left corner and then OK in the dialog box to save the configuration.

Figure 7 Saving the configuration
After saving the configuration, switch to the Instances tab page, select the instance that has expired, click More, and select Instance Rolling Restart to make the configuration take effect.

Figure 8 Performing a rolling instance restart