Adding a Ranger Access Permission Policy for Hive

Scenarios

On enterprise big data platforms, Hive serves as a core data warehouse tool that supports key business functions such as data storage, querying, and analysis. Users with different roles must access specific databases and tables in Hive based on their business requirements.

As a centralized access control framework in the big data ecosystem, Ranger allows you to configure permission policies for Hive users in the Web UI. This document describes how to configure access control policies for Hive users in the Ranger Web UI. These policies enable granular permission control over Hive resources, ensuring both data security and service availability.

In production environments, coarse-grained access control that restricts user access at the database and table level is often insufficient for protecting sensitive information. Ranger's Hive data masking feature addresses this challenge by dynamically processing the results of user SELECT operations and masking sensitive data in real time based on configured policies.

Furthermore, coarse-grained access control at the database and table level often fails to meet strict data isolation requirements. For example, granting a user SELECT permissions on an entire table may expose sensitive data outside their scope of responsibility, increasing data leakage risks. Conversely, restricting access to only specific tables can reduce query efficiency due to scattered data storage. Ranger supports row-level data filtering. When a user performs a SELECT operation on a Hive table, Ranger filters the returned rows based on preset rules to ensure the user only sees authorized data.

Prerequisites

• The Ranger service has been installed and is running properly in the cluster.
• The users, user groups, or roles requiring permissions must already be created in the cluster. For newly created users, you can configure permission policies only after the users are automatically synchronized to Ranger.

• The related user has been added to the hive user group.

Adding a Hive Permission Policy

1. Log in to the Ranger web UI as the Ranger administrator. For details, see Logging In to the Ranger Web UI.
2. On the home page, click the component plug-in name in the HADOOP SQL area, for example, Hive.
3. On the Access tab page, click Add New Policy to add a Hive permission control policy.
4. Configure the parameters listed in the table below based on the service demands.

   Table 1 Hive permission parameters

   Parameter	Description
   Policy Name	Policy name, which can be customized and must be unique in the service.
   Policy Conditions	IP address filtering policy, which can be customized. You can enter one or more IP addresses or IP address segments. An IP address can contain the wildcard character (*), for example, 192.168.1.10,192.168.1.20 or 192.168.1.*.
   Policy Label	A label specified for the current policy. You can search for reports and filter policies based on labels.
   database	Name of the Hive database to which the policy applies. The Include policy applies to the current input object, and the Exclude policy applies to objects other than the current input object.
   table	Name of the Hive table to which the policy applies. To add a UDF-based policy, switch to UDF and enter the UDF name. The Include policy applies to the current input object, and the Exclude policy applies to objects other than the current input object. NOTE: For MRS 3.6.0-LTS or later, permission requirements for view authorization depend on the value of the hive.cbo.enable parameter on the Hive server. When hive.cbo.enable is set to true: For views created from standard tables, you must grant the user permissions for both the view itself and the table path. For views created from partitioned tables, you must grant the user permissions for the view itself, the table path, and the specific partitions. When hive.cbo.enable is set to false: Regardless of whether a view is created from a standard table or a partitioned table, you only need to grant the user permissions for the view itself and the table path.
   Hive Column	Name of the column to which the policy applies. The value * indicates all columns. The Include policy applies to the current input object, and the Exclude policy applies to objects other than the current input object.
   Description	Policy description.
   Audit Logging	Whether to generate an audit log when a request matches the policy. Yes: An audit log is generated whenever an access request matches the policy, regardless of whether the result is Allow or Deny. No: No audit log is generated when an access request matches the policy.
   Allow Conditions	Policy allow conditions, which define the permissions and exceptions authorized by this policy. In the Select Role, Select Group, and Select User columns, choose the specific roles, user groups, or users to whom the permissions will be granted. Click Add Conditions and specify the IP address range to which this policy applies. Click Add Permissions to assign the corresponding access rights. select: permission to query data update: permission to update data Create: permission to create data Drop: permission to drop data Alter: permission to alter data Index: permission to index data All: all permissions Read: permission to read data Write: permission to write data Temporary UDF Admin: temporary UDF management permission Select/Deselect All: permission to select or deselect all To add multiple permission control rules, click . If users or user groups in the current condition need to manage this policy, select Delegate Admin. These users will become the agent administrators. The agent administrators can update and delete this policy and create sub-policies based on the original policy.
   Deny Conditions	Policy deny conditions, which define the permissions and exceptions that must be rejected by the policy. The configuration method is identical to that of Allow Conditions.

   Table 2 Common permission configuration scenarios

   Task	Role Authorization
   role admin operation	On the home page, click Settings and choose Roles. Click the role with Role Name set to admin. In the Users area, click Select User and select a username. Click Add Users, select Is Role Admin in the row where the username is located, and click Save. Only the rangeradmin user has permissions to access the Settings menu on the Ranger web UI. After a user is assigned the Hive administrator role, they must complete the following operations during each maintenance session: Log in to the node where the Hive client is installed as the client installation user. Run the following command to configure environment variables: source Client installation directory/bigdata_env Run the following commands to authenticate the user: kinit Hive service user Run the following command to log in to the client tool: beeline Run the following command to update the administrator permissions: set role admin;
   Creating a database table	Enter the policy name in Policy Name. Enter or select the corresponding database on the right side of database and enter or select * on the right side of column. (To create a table, enter or select the corresponding table on the right side of table.) In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Create.
   Deleting a table	Enter the policy name in Policy Name. Enter or select the corresponding database on the right side of database and enter and select * on the right side of column. (To delete a table, enter or select the corresponding table on the right side of table.) In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Drop.
   Query operation (select, desc, and show)	Enter the policy name in Policy Name. Enter or select the corresponding database on the right side of database and enter or select * (* indicates all columns) on the right side of column. (To create a table, enter or select the corresponding table on the right side of table.) In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select select.
   Alter operation	Enter the policy name in Policy Name. Enter and select the corresponding database on the right side of database and enter or select * on the right side of column. (For tables, enter or select the corresponding table on the right side of table.) In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Alter.
   LOAD operation	Enter the policy name in Policy Name. On the right side of database, enter or select the corresponding database. On the right side of table, enter or select the corresponding table. On the right side of column, enter a column and select *. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select update.
   INSERT and DELETE operations	Enter the policy name in Policy Name. On the right side of database, enter or select the corresponding database. On the right side of table, enter or select the corresponding table. On the right side of column, enter a column and select *. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select update. Configure the submit permission on the Yarn task queue. For details about how to configure the permission, see Adding a Ranger Access Permission Policy for YARN.
   Import/Export operation	This scenario applies only to MRS 3.2.0 or later. Enter the policy name in Policy Name. On the right side of database, enter or select the corresponding database. On the right side of table, enter or select the corresponding table. On the right side of column, enter a column and select *. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select select.
   Repl Dump/Load operation	This scenario applies only to MRS 3.2.0 or later. Enter the policy name in Policy Name. On the right side of database, enter or select the corresponding database. On the right side of table, enter a table or select *. On the right side of column, enter a column or select *. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select ReplAdmin.
   GRANT/REVOKE operation	Enter the policy name in Policy Name. On the right side of database, enter or select the corresponding database. On the right side of table, enter or select the corresponding table. On the right side of column, enter a column and select *. In the Allow Conditions area, select a user from the Select User drop-down list. Select Delegate Admin.
   ADD JAR operation	Enter the policy name in Policy Name. Click database, and select global from the drop-down list. On the right of global, enter related information or select *. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select Temporary UDF Admin.
   UDF operation	Enter the policy name in Policy Name. Enter or select the corresponding database on the right of database, and enter the corresponding udf function name on the right of udf. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select the required permissions for the user (UDF operations support Create, Select, and Drop permissions).
   VIEW operation	Enter the policy name in Policy Name. On the right side of database, enter or select the corresponding database. On the right side of table, enter or select the corresponding view. On the right side of column, enter a column and select *. In the Allow Conditions area, select a user from the Select User drop-down list. Click Add Permissions and select permissions for the user as required.
   dfs command operation	The dfs operation can be performed only after you have run the set role admin command.
   Operations on other user database tables	Perform the preceding operations to add the corresponding permissions. Grant the read, write, and execution permissions on the HDFS paths of other user database tables to the user. For details, see Adding a Ranger Access Permission Policy for HDFS.

   

   • If you have specified an HDFS path when running commands, you need to be granted with the read, write, and execution permissions on the HDFS paths. For details, see Adding a Ranger Access Permission Policy for HDFS. You do not need to configure the Ranger policy of HDFS. You can use the Hive permission plug-in to add permissions to the role and assign the role to the corresponding user. If the HDFS Ranger policy can match the file or directory permission of the Hive database table, the HDFS Ranger policy is preferentially used.
   • MRS 3.3.0 or later: If the cascading authorization function of Hive tables has been enabled by referring to Configuring Cascading Authorization for Hive Tables, you do not need to authorize the HDFS path where the table is located.
   • If the Hive table is stored on OBS, you can use the URL policy within the Ranger policy. Set the URL to the complete path of the object on OBS. The read and write permissions are used together with the URL. URL policies are not involved in other scenarios.
   • The global policy in Ranger is used exclusively to associate with the Temporary UDF Admin permission to control UDF package uploads.
   • The hiveservice policy in the Ranger policy is used only with the Service Admin permission to control the permission to run the kill query <queryId> command to end the task that is being executed.
   • The lock, index, refresh, and replAdmin permissions are not supported.
   • Run the show grant command to view the table permission. The grantor column of the table owner is displayed as user hive. If the Ranger page is used or the grant command is used to grant permissions in the background, the grantor column is displayed as the corresponding user. To view the result of using the Hive permission plug-in, set hive-ext.ranger.previous.privileges.enable to true and run the show grant command.

5. Click Add to view basic information about the policy in the policy list. After the policy takes effect, check whether the related permissions are normal.

   To disable a policy, click and set the policy to Disabled.

   If a policy is no longer used, click to delete it.

Configuring Hive Data Masking

1. Log in to the Ranger web UI. Click Hive in the HADOOP SQL area on the homepage.

   

2. On the Masking tab page, click Add New Policy to add a Hive permission control policy.

   

3. Configure the parameters listed in the table below based on the service demands.

   Table 3 Hive data masking parameters

   Parameter	Description
   Policy Name	Policy name, which can be customized and must be unique in the service.
   Policy Conditions	IP address filtering policy, which can be customized. You can enter one or more IP addresses or IP address segments. An IP address can contain the wildcard character (*), for example, 192.168.1.10,192.168.1.20 or 192.168.1.*.
   Policy Label	A label specified for the current policy. You can search for reports and filter policies based on labels.
   Hive Database	Name of the Hive database to which the current policy applies in versions earlier than MRS 3.3.0. In MRS 3.3.0 and later versions, multiple database names can be configured and wildcards (*) are supported, for example, aa, a*, *b, a*b, or *.
   Hive Table	Name of the Hive table to which the current policy applies in versions earlier than MRS 3.3.0. In MRS 3.3.0 and later versions, multiple table names can be configured and wildcards (*) are supported, for example, aa, a*, *b, a*b, or *.
   Hive Column	Name of the column to be added in versions earlier than MRS 3.3.0. In MRS 3.3.0 and later versions, multiple column names can be configured and wildcards (*) are supported, for example, aa, a*, *b, a*b, or *.
   Description	Policy description.
   Audit Logging	Whether to generate an audit log when a request matches the policy. Yes: An audit log is generated whenever an access request matches the policy, regardless of whether the result is Allow or Deny. No: No audit log is generated when an access request matches the policy.
   Transfer Mask	Whether the policy is automatically transferred when dynamic masking is enabled. For details about how to configure Hive dynamic masking, see Configuring Hive Dynamic Data Masking.
   Mask Conditions	In the Select Role, Select Group, and Select User columns, choose the specific roles, groups, or users to whom the permissions will be granted. Click Add Conditions and specify the IP address range to which this policy applies. Click Add Permissions and select Select. Click Select Masking Option and select a data masking policy. Redact: Use x to mask all letters and 0 to mask all digits. Partial mask: show last 4: Only the last four characters are displayed. Other characters are masked with x. Masking of Chinese characters is not supported. Partial mask: show first 4: Only the first four characters are displayed. Other characters are masked with x. Masking of Chinese characters is not supported. Hash: Replace the original value with the hash value. The Hive built-in function mask_hash is used. This is valid only for fields of the string, character, and varchar types. NULL is returned for fields of other types. Nullify: Replace the original value with the NULL value. Unmasked (retain original value): Keep the original value. Date: show only year: Only the year part of the date string is displayed, and the default month and date start from January and Monday (01/01). Custom: You customize policies using any valid return data type which is the same as the data type in the masked column. To add a multi-column masking policy, click .

4. Click Add to view basic information about the policy in the policy list.
5. After you perform the select operation on a table configured with a data masking policy on the Hive client, the system processes and displays the data.
   

   To process data, you must have the permission to submit tasks to the Yarn queue.

Configuring Hive Row-Level Data Filtering

1. Log in to the Ranger web UI. Click Hive in the HADOOP SQL area on the homepage.

   

2. On the Row Level Filter tab page, click Add New Policy to add a row data filtering policy.

   

3. Configure the parameters listed in the table below based on the service demands.

   Table 4 Parameters for filtering Hive row data

   Parameter	Description
   Policy Name	Policy name, which can be customized and must be unique in the service.
   Policy Conditions	IP address filtering policy, which can be customized. You can enter one or more IP addresses or IP address segments. An IP address can contain the wildcard character (*), for example, 192.168.1.10,192.168.1.20 or 192.168.1.*.
   Policy Label	A label specified for the current policy. You can search for reports and filter policies based on labels.
   Hive Database	Name of the Hive database to which the current policy applies.
   Hive Table	Name of the Hive table to which the current policy applies.
   Description	Policy description.
   Audit Logging	Whether to generate an audit log when a request matches the policy. Yes: An audit log is generated whenever an access request matches the policy, regardless of whether the result is Allow or Deny. No: No audit log is generated when an access request matches the policy.
   Row Filter Conditions	In the Select Role, Select Group, and Select User columns, choose the specific roles, groups, or users to whom the permissions will be granted. Click Add Conditions and specify the IP address range to which this policy applies. Click Add Permissions and select Select. Click Row Level Filter and enter data filtering rules. For example, to filter out data where the name column equals zhangsan in table A, configure the filtering rule as name <> 'zhangsan'. For more information, see the Apache Ranger official documentation. To add more rules, click .

4. Click Add to view basic information about the policy in the policy list.
5. When you use the Hive client to perform a SELECT operation on a table configured with a data masking policy, the system processes the data and displays the masked results.

   To process data, you must have permissions to submit jobs to the corresponding YARN queue.

Helpful Links

• For details about the priorities of different Ranger policies, see Condition Priorities of the Ranger Permission Policy.
• To view information about permission objects in Ranger, such as users, user groups, and roles, see Viewing Ranger User Permission Synchronization Information.
• You can create new users for an MRS cluster in MRS Manager. For details, see Creating an MRS Cluster User.