grant permissions in hive does not work on hdp2.2

Question

I'm experimenting with HDP2.2 cluster with Ambari setup on CentOS 6.5 and I have problems with running Hive GRANT queries. For example, a query

grant select on Tbl1 to user root;

gives me an exception that looks like that

FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.DDLTask. Failed to retrieve roles for hdfs: Metastore Authorization api invocation for remote metastore is disabled in this configuration.

What's going on here and could you explain the meaning of 'retrieve roles for hdfs'? Is that a 'hdfs' system user or some specific hadoop user?

From what i've been reading, it seems that problem is with some hive settings. Is there a way to turn security off somehow or tweak it in a right way using hive-site.xml ?

Answer 1

Below are the setting in your hive-site.xml?

hive.security.metastore.authorization.manager org.apache.hadoop.hive.ql.security.authorization.StorageBasedAuthorizationProvider,org.apache.hadoop.hive.ql.security.authorization.MetaStoreAuthzAPIAuthorizerEmbedOnly

This will restrict any Grant/Revoke statements through beeline/hive-server2 interface only.

Setting "MetaStoreAuthzAPIAuthorizerEmbedOnly" is in addition to "StorageBasedAuthorizationProvider" and its sole purpose is to disable grant/revoke through hive-cli. To use SQL authorization fully, this setting gives single point of control for providing SQL based authorization. If you remove this setting, anybody from Hive-CLI can set him/herself admin and bypass SQL-based privileges.