User Permissions

Scenarios

If Kerberos authentication is enabled for the cluster (the cluster is in security mode), HetuEngine provides the following two permission control modes and uses the Ranger permission model by default. If Kerberos authentication is disabled for the cluster (the cluster is in normal mode), the Ranger permission model is the only option and is disabled by default. The Ranger permission model can be enabled in MRS 3.2.0-LTS.1 (with the 3.2.0.1.10 or later patch installed) and later versions.

• For details about the Ranger permission model, see HetuEngine Ranger-based Permission Control.
• For details about the MetaStore permission model, see HetuEngine MetaStore-based Permission Control.

Notes and Constraints

• Using HetuEngine to accessing data sources in the same cluster:
  • If Ranger authentication is enabled for HetuEngine, the PBAC permission policy of Ranger is used for authentication.
  • If Ranger authentication is disabled for HetuEngine, the RBAC permission policy of MetaStore is used for authentication.

• Using HetuEngine to accessing data sources in different clusters:

  Permission policies are determined by both HetuEngine and data source permissions. (In Hive, they depend on HDFS.)

• To query a view, you only need the SELECT permission on the view. For join queries using a view, the SELECT permission must be granted on both the view and the table.
• Columns in GaussDB and HetuEngine data sources cannot be masked.

Changing the HetuEngine permission control type restarts the entire HetuEngine service, including any running HetuEngine compute instances on the HSConsole page.

HetuEngine Ranger-based Permission Control

By default, Ranger authentication is used for newly installed clusters. For clusters upgraded from earlier versions or clusters where Ranger authentication is manually disabled, you can enable Ranger authentication again by referring to the following content.

For a cluster with Ranger authentication enabled, cluster administrators can use Ranger to configure the permissions to manage databases, tables, and columns of data sources for HetuEngine users. For details, see Adding a Ranger Access Permission Policy for HetuEngine.

1. Log in to MRS Manager.

   For details about how to log in to MRS Manager, see Accessing MRS Manager.

2. In MRS 3.3.0-LTS or later, add the ranger.usersync.sync.source parameter if Kerberos authentication is disabled for the cluster (the cluster is in normal mode). Skip this step if Kerberos authentication is enabled for the cluster (the cluster is in security mode).
   1. Choose Cluster > Services > Ranger. Click Configurations and then All Configurations.
   2. Search for ranger.usersync.config.expandor, set its name to ranger.usersync.sync.source and value to ldap, and save the settings.
   3. On the Dashboard page, click More > Restart Service in the upper right corner, enter the password, and restart Ranger.
   In MRS 3.5.0-LTS or later, perform the following steps to add the ranger.usersync.sync.source parameter when Kerberos authentication is disabled for the cluster (the cluster is in normal mode):

   1. Choose Cluster > Services > Ranger. Click Configurations and then All Configurations.
   2. Search for ranger.usersync.sync.source, ensure that its value is set to ldap, and save the settings.
   3. On the Dashboard page, click More > Restart Service in the upper right corner, enter the password, and restart Ranger.

3. Choose Cluster > Services > HetuEngine. Click More and select Enable Ranger.
4. Choose Cluster > Services > HetuEngine. Click More and select Restart Service.
5. Restart the compute instance on the HSConsole page.

HetuEngine MetaStore-based Permission Control

• Constraints: This function applies only to Hive data sources.

  When multiple HetuEngine clusters are deployed for collaborative computing, metadata is centrally managed by the management cluster, while data computing is distributed across all clusters. User permissions for accessing HetuEngine clusters must be configured in the management cluster. Hive group users with usernames identical to HetuEngine users must be created and added to all compute instances.

• Enabling MetaStore authentication
  1. Log in to MRS Manager.

     For details about how to log in to MRS Manager, see Accessing MRS Manager.

  2. Choose Cluster > Services > HetuEngine. Click More and select Disable Ranger.
  3. Choose Cluster > Services > HetuEngine. Click More and select Restart Service.
  4. Restart the compute instance on the HSConsole page.
• MetaStore Permissions

  Similar to Hive, HetuEngine is a data warehouse framework built on Hadoop. It supports SQL-like querying of structured data.

  Within a cluster, permissions must be assigned to roles. These roles are then bound to users or user groups. Users can obtain permissions only by binding with a role or by joining a group associated with a role.

  HetuEngine permission management is performed by the permission system to manage users' operations on the database, ensuring that different users can operate databases independently and securely. A user can operate another user's tables and databases only with the corresponding permissions. Otherwise, operations will be rejected.

  HetuEngine permission management integrates Hive's permission management functions. The Hive MetaStore service and the web-based permission granting function are required to use HetuEngine permission management.

  • Granting permissions on the web page: HetuEngine supports granting permissions only through the web page. On FusionInsight Manager, choose System > Permission to add or delete a user, user group, or role, and to grant or revoke permissions.
  • Obtaining and checking permissions: When DDL or DML commands from a client are received, HetuEngine retrieves the client user's database permissions from MetaStore and verifies whether the required permissions are included. If the permissions are present, the operation proceeds. If not, the operation is denied. After MetaStore permissions are verified, ACL permissions must also be checked on HDFS.
• HetuEngine permission model

  To perform SQL queries in HetuEngine, users must be granted permissions on HetuEngine databases and tables, including external tables and views. The complete HetuEngine permission model includes both metadata permissions and HDFS file permissions. Permissions required to use a database or table are only one category within the overall HetuEngine permission model.

  • Metadata permissions

    Metadata permissions are enforced at the metadata level. As in traditional relational databases, HetuEngine databases support CREATE and SELECT permissions, while tables and columns support SELECT, INSERT, UPDATE, and DELETE permissions. HetuEngine also supports the owner permission OWNERSHIP and cluster administrator permission ADMIN.

  • Data file permissions (that is, HDFS file permissions)

    HetuEngine database and table files are stored in HDFS. By default, created databases and tables are stored in the /user/hive/warehouse directory of HDFS. The system automatically creates subdirectories named after database names and database table names. To access a database or a table, the corresponding file permissions (read, write, and execute) on the HDFS are required.

  To perform operations on HetuEngine databases or tables, you need to associate the metadata permission with the HDFS file permission. For example, to query HetuEngine data tables, you need to associate the metadata permission SELECT with the HDFS file permissions READ and EXECUTE.

  FusionInsight Manager provides a GUI-based role management function for managing HetuEngine database and table permissions. You only need to configure metadata permissions, and the system automatically associates and applies the corresponding HDFS file permissions, simplifying operations and improving efficiency.

• HetuEngine application scenarios and related permissions

  To create a database with HetuEngine, a user must be a member of the Hive group. Role authorization is not required. In Hive or HDFS, users have full permissions on the databases and tables they create. They can create tables, query, insert, update, and delete data, as well as grant permissions to other users for accessing the tables and related HDFS directories and files.

  To access tables or databases created by other users, a user must be granted the appropriate permissions. The permissions the user requires vary depending on the specific HetuEngine application scenario.

  Table 2 HetuEngine application scenarios

  Typical Scenario	Required Permission
  Using HetuEngine tables, columns, or databases	Permissions required in different scenarios are as follows: To create a table, the CREATE permission is required. To query data, the SELECT permission is required. To insert data, the INSERT permission is required.

  In some special HetuEngine application scenarios, other permissions must be configured separately.

  Table 3 Special HetuEngine application scenarios and required permissions

  Scenario	Required Permission
  Creating HetuEngine databases, tables, and external tables, or adding partitions to existing tables or external tables when data files specified by Hive users are stored in HDFS directories other than /user/hive/warehouse.	The directory must exist, the client user must be the owner of the directory, and the user must have the Read, Write, and Execute permissions on the directory. The user must have the Read and Execute permissions on all the upper-layer directories of the directory.
  Performing operations on all databases and tables in Hive	The user must be added to the supergroup user group, and be assigned the ADMIN permission.

• Configuring permissions for tables, columns, and databases

  After MetaStore authentication is enabled, users must be granted the appropriate permissions to access HetuEngine tables or databases created by others. HetuEngine supports column-based permission control for strict access control. To access specific columns in tables created by other users, a user must be granted the appropriate column permissions.

  

  • Permissions granted on tables within a database are automatically associated with the HDFS permissions of the database directory, simplifying permission management. Revoking table permissions does not automatically revoke the corresponding HDFS permissions on the database directory. This design improves performance, but users can only log in to the database and view table names.
  • When the query permission on a database is granted to or revoked from a role, the same permission on all tables in the database is automatically granted or revoked. This mechanism is inherited from Hive.
  • In HetuEngine, column names of the struct data type can contain only letters, digits, and underscores (_). (Other special characters are not allowed.) If a column name of the struct data type contains special characters, it may not be displayed correctly on MRS Manager when you grant permissions to roles on the Role page.

  Procedure

  1. Log in to MRS Manager.
  2. Choose System > Permission > Role.
  3. Click Create Role, and set Role Name and Description.
  4. In the Configure Resource Permission area, choose Name of the desired cluster > Hive and set role permissions. For details, see Table 4.
     • Hive Admin Privilege: Hive administrator permissions.
     • Hive Read Write Privileges: Hive data table management permissions that allow users to configure and manage data in created tables.
     

     • Hive role management supports administrator permissions and table/view access permissions, but does not support database-level permissions.
     • Hive administrator permissions do not include the permission to manage HDFS.
     • If there are too many tables in the database or too many files in tables, the permission granting may last for a while. For example, if a table contains 10,000 files, the permission granting lasts about 2 minutes.

     Table 4 Configuring a role

     Task	Role Authorization
     Setting the permission to query a table of another user in the default database	In the View Name area, click Hive Read Write Privileges. Click the name of the target database in the database list. Tables in the database are displayed. In the Permission column of a specified table, choose Select.
     Setting the permission to import data to a table of another user in the default database	In the View Name area, click Hive Read Write Privileges. Click the name of the target database in the database list. Tables in the database are displayed. In the Permission column of a specified table, select Delete and Insert.

  5. Click OK. The system returns to the Role page.
     

     After the role is created, you can create a HetuEngine user and assign related role permissions to the user by referring to Creating a HetuEngine Permission Role.

  Table 5 describes the permission requirements when SQL statements are processed in HetuEngine.

  Table 5 Using HetuEngine tables, columns, or data

  Scenarios	Required Permission
  DESCRIBE TABLE	Select
  ANALYZE TABLE	Select and Insert
  SHOW COLUMNS	Select
  SHOW TABLE STATUS	Select
  SHOW TABLE PROPERTIES	Select
  SELECT	Select
  EXPLAIN	Select
  CREATE VIEW	Select, Grant Of Select, and Create
  CREATE TABLE	Create
  ALTER TABLE ADD PARTITION	Insert
  INSERT	Insert
  INSERT OVERWRITE	Insert and Delete
  ALTER TABLE DROP PARTITION	Table-level Alter and Delete, and column-level Select
  ALTER DATABASE	Hive Admin Privilege