Help Center/ MapReduce Service/ Component Operation Guide (Normal)/ Using Hive/ Hive User Permission Management/ Creating a Hive Role
Updated on 2024-10-08 GMT+08:00
View PDF
Share

Creating a Hive Role

Scenario

Create and configure a Hive role on Manager as an MRS cluster administrator. The Hive role can be granted the permissions of the Hive administrator and the permissions to operate Hive table data.

Creating a database with Hive requires users to join in the hive group, without granting a role. Users have all permissions on the databases or tables created by themselves in Hive or HDFS. They can create tables, select, delete, insert, or update data, and grant permissions to other users to allow them to access the tables and corresponding HDFS directories and files. The created databases or tables are saved in the /user/hive/warehouse directory of the HDFS by default.

  • A Hive role can be created only in security mode.
  • If the current component uses Ranger for permission control, you need to configure permission management policies based on Ranger. For details, see Adding a Ranger Access Permission Policy for Hive for MRS 3.x or later that supports Ranger.

Prerequisites

  • The MRS cluster administrator has understood service requirements.
  • Log in to FusionInsight Manager.
  • The Hive client has been installed.

Procedure

For versions earlier than MRS 3.x, perform the following operations to create a Hive role:

  1. Log in to MRS Manager.
  2. Choose System > Permission > Manage Role.
  3. Click Create Role, and set Role Name and Description.
  4. Set permissions. For details, see Table 1.

    • Hive Admin Privilege: Hive administrator permissions. If you want to use this permission, run the set role admin command to set the permission before running SQL statements.
    • Hive Read Write Privileges: Hive data table management permission, which is the operation permission to set and manage the data of created tables. Select the permissions of a database as required. To specify permissions on tables, click the database name and select the permissions of the tables.
    • Hive role management supports Hive administrator permissions and the permissions to access tables and views, but does not support granting permissions on databases.
    • The permissions of the Hive administrator do not include the permission to manage HDFS.
    • If there are too many tables in the database or too many files in tables, the permission granting may last a while. For example, if a table contains 10,000 files, the permission granting lasts about 2 minutes.
    Table 1 Setting a role

    Scenario

    Role Authorization

    Setting the Hive administrator permission

    In the Permission table, click Hive and select Hive Admin Privilege.

    NOTE:

    After being bound to the Hive administrator role, perform the following operations during each maintenance operation:

    1. Log in to the node where the client is installed. For details, see Installing a Client.
    2. Run the following command to configure environment variables:

      For example, if the Hive client installation directory is /opt/hiveclient, run source /opt/hiveclient/bigdata_env.

    3. Run the following command to authenticate the user:

      kinit Hive service user

    4. Run the following command to log in to the client tool:

      beeline

    5. Run the following command to update the administrator permissions of the Hive user:

      set role admin;

    Setting the permission to query a table of another user in the default database
    1. In the Permission table, choose Hive > Hive Read Write Privileges.
    2. In the Permission column of the specified table, select SELECT.

    Setting the permission to query a table of another user in the default database
    1. In the Permission table, choose Hive > Hive Read Write Privileges.
    2. In the Permission column of the specified table, select Insert.

    Setting the permission to import data to a table of another user in the default database
    1. In the Permission table, choose Hive > Hive Read Write Privileges.
    2. In the Permission column of the specified table, select Delete and Insert.

    Setting the permission to submit HQL commands to Yarn for execution

    The HQL commands used by some services are converted into MapReduce tasks and submitted to Yarn for execution. You need to set the Yarn permissions. For example, the HQL statements to be run use statements, such as insert, count, distinct, group by, order by, sort by, or join.

    1. In the Permission table, choose Yarn > Scheduler Queue > root.
    2. In the Permission column of the default queue, select Submit.

  5. Click OK, and return to the Role page.
  6. Choose System > Manage User > Create User.
  7. Enter the username, set User Type to Human-machine, set the user password, add a user group bound with the Hive administrator role, bind the new Hive role to the user group, and click OK.
  8. After the user is created, you can run the SQL statement using the user.

For MRS 3.x or later, perform the following operations to create a Hive role:

  1. Log in to FusionInsight Manager. For details, seeAccessing FusionInsight Manager (MRS 3.x or Later)
  2. Choose System > Permission > Role.
  3. Click Create Role, and set Role Name and Description.
  4. Set Configure Resource Permission. For details, see Table 2.

    • Grant the read and execution permissions for the HDFS directory.
      • Click Name of the desired cluster and select HDFS for Service Name. On the displayed page, click File System, choose hdfs://hacluster/ > user, locate the row where hive is located, and select Read and Execute in the Permission column.
      • Click Name of the desired cluster and select HDFS for Service Name. On the displayed page, click File System, choose hdfs://hacluster/ > user > hive, locate the row where warehouse is located, and select Read and Execute in the Permission column.
      • Click Name of the desired cluster and select HDFS for Service Name. On the displayed page, click File System, choose hdfs://hacluster/ > tmp, locate the row where hive-scratch is located, and select Read and Execute in the Permission column.
    • Hive Admin Privilege: Hive administrator permission.
    • Hive Read Write Privileges: Hive data table management permission, which is the operation permission to set and manage the data of created tables.
    • In MRS 3.1.0, Hive role management supports the Hive administrator permission, and the permissions of accessing tables and views, without granting the database permission.
    • For MRS 3.1.2 or later, Hive role management supports the administrator permissions and the permission of accessing databases, tables, and views.
    • The permissions of the Hive administrator do not include the permission to manage HDFS.
    • If there are too many tables in the database or too many files in tables, the permission granting may last a while. For example, if a table contains 10,000 files, the permission granting lasts about 2 minutes.
    Table 2 Setting a role

    Task

    Role Authorization

    Setting the Hive administrator permission

    In the Configure Resource Permission table, choose Name of the desired cluster > Hive and select Hive Admin Privilege.

    NOTE:

    After being bound to the Hive administrator role, perform the following operations during each maintenance operation:

    1. Log in to the node where the Hive client is installed as the client installation user.
    2. Run the following command to configure environment variables:

      For example, if the Hive client installation directory is /opt/hiveclient, run source /opt/hiveclient/bigdata_env.

    3. Run the following command to authenticate the user:

      kinit Hive service user

    4. Run the following command to log in to the client tool:

      beeline

    5. Run the following command to update the administrator permissions of the Hive user:

      set role admin;

    Setting the permission to query a table of another user in the default database
    1. In the Configure Resource Permission table, choose Name of the desired cluster > Hive > Hive Read Write Privileges.
    2. Click the name of the specified database in the database list. Tables in the database are displayed.
    3. In the Rights column of the specified table, choose Select.

    Setting the permission to query a table of another user in the default database
    1. In the Configure Resource Permission table, choose Name of the desired cluster > Hive > Hive Read Write Privileges.
    2. Click the name of the specified database in the database list. Tables in the database are displayed.
    3. In the Permission column of the specified table, select INSERT.

    Setting the permission to import data to a table of another user in the default database
    1. In the Configure Resource Permission table, choose Name of the desired cluster > Hive > Hive Read Write Privileges.
    2. Click the name of the specified database in the database list. Tables in the database are displayed.
    3. In the Permission column of the specified indexes, select DELETE and INSERT.

    Setting the permission to submit HQL commands to Yarn for execution

    The HQL commands used by some services are converted into MapReduce tasks and submitted to Yarn for execution. You need to set the Yarn permissions. For example, the HQL statements to be run use statements, such as insert, count, distinct, group by, order by, sort by, or join.

    1. In the Permission table, choose Name of the desired cluster > Yarn > Scheduling Queue > root.
    2. In the Permission column of the default queue, select Submit.

  5. Click OK, and return to the Role page.
  6. Choose Permission > User. On the displayed page, click Create User.
  7. Enter the username, set User Type to Human-machine, set the user password, add a user group with Hive permissions, select the primary group, bind the new role to the user group, and click OK.
  8. Run SQL statements as the created user.