Apache Sentry是一个可以对Hadoop集群中的数据及元数据进行细粒度管理的权限管理系统。Sentry目前可以与ApacheHive,HiveMetastore / HCatalog,Apache Solr,Impala和HDFS(仅限于Hive表数据)等进行集成,对其数据进行权限管理。
配置数据库
安装完毕
需要说明的是,只有Hiveserver2支持Sentry插件,故若想对Hive中的表作权限管理,只能使用beeline客户端。对于Hive CLI,可将hive脚本的执行权限做出限定,只保留hive用户(Hive系统用户)对它的执行权限。
在hive配置项中搜索“HiveServer2 启用模拟”,取消勾选
启用数据库中的存储通知
Sentry
设置sentry.hive.testing.mode 为 true
启用HDFS ACL与Sentry同步之后,Sentry会将对Hive中数据库和表的访问权限同步映射到该表对应的HDFS的文件上。如不开启同步,则可能会出现,某个用户对Hive中的某张表无访问权限,但是对该表在HDFS上文件具有访问权限的问题,故推荐开启HDFS ACL与Sentry同步。需要说明的是,该同步只对Hive中的数据库和表在HDFS上的路径生效,HDFS其余路径的ACL不受影响。
启用访问控制列表
Sentry同步
基本概念
object:受保护的对象,例如Hive中的一张表test_tableprivilege:对object的访问权限,例如对test_table的读权限role:角色(privilege的集合),例如数仓开发人员(对test_tbl的读与写权限)user:用户,例如张三group:user的集合,例如大数据离线数仓开发组
hue集成sentry
beeline> ! connect jdbc:hive2://cdh002:10000
Connecting to jdbc:hive2://cdh002:10000
Enter username for jdbc:hive2://cdh002:10000: hive
Enter password for jdbc:hive2://cdh002:10000:
Connected to: Apache Hive (version 2.1.1-cdh6.3.2)
Driver: Hive JDBC (version 2.1.1-cdh6.3.2)
Transaction isolation: TRANSACTION_REPEATABLE_READ
0: jdbc:hive2://cdh002:10000>
创建角色admin,并赋予权限
0: jdbc:hive2://cdh002:10000> create role admin;0: jdbc:hive2://cdh002:10000> grant all on server server1 to role admin;
讲admin用户授权给hive用户组
这样admin就成了管理员用户了
0: jdbc:hive2://cdh002:10000> grant role admin to group hive;
创一个测试表,在default库里,并插入数据
0: jdbc:hive2://cdh002:10000> create table test (s1 string, s2 string) row format delimited fields terminated by ',';
0: jdbc:hive2://cdh002:10000> insert into test values('a','b'),('1','2');
查看已有得用户
0: jdbc:hive2://cdh002:10000> show roles;
在每台服务器上,都添加用户user_r, user_w
useradd user_r
useradd user_w
创建角色read, write。并赋予read角色对test表得select权限,write角色对test表得insert权限
0: jdbc:hive2://cdh002:10000> create role read;
0: jdbc:hive2://cdh002:10000> create role write;
0: jdbc:hive2://cdh002:10000> grant select on table test to role read;
0: jdbc:hive2://cdh002:10000> grant insert on table test to role write;
为user_r用户组授权read角色,为user_w用户组授write角色
0: jdbc:hive2://cdh002:10000> grant role read to group user_r;
0: jdbc:hive2://cdh002:10000> grant role write to group user_w;
查看权限授予情况查看所有role(管理员)SHOW ROLES;
查看指定用户组的role(管理员)SHOW ROLE GRANT GROUP test;
查看当前认证用户的roleSHOW CURRENT ROLES;
查看指定ROLE的具体权限(管理员)SHOW GRANT ROLE test_role;
登录user_r用户,只能读,不能写
beeline> !connect jdbc:hive2://cdh002:10000
Connecting to jdbc:hive2://cdh002:10000
Enter username for jdbc:hive2://cdh002:10000: user_r
Enter password for jdbc:hive2://cdh002:10000:
Connected to: Apache Hive (version 2.1.1-cdh6.3.2)
Driver: Hive JDBC (version 2.1.1-cdh6.3.2)
Transaction isolation: TRANSACTION_REPEATABLE_READ
0: jdbc:hive2://cdh002:10000> show tables;
INFO : Compiling command(queryId=hive_20230307174342_be0a401c-ee13-4864-82c6-ef44eb28090f): show tables
INFO : Semantic Analysis Completed
INFO : Returning Hive schema: Schema(fieldSchemas:[FieldSchema(name:tab_name, type:string, comment:from deserializer)], properties:null)
INFO : Completed compiling command(queryId=hive_20230307174342_be0a401c-ee13-4864-82c6-ef44eb28090f); Time taken: 0.178 seconds
INFO : Executing command(queryId=hive_20230307174342_be0a401c-ee13-4864-82c6-ef44eb28090f): show tables
INFO : Starting task [Stage-0:DDL] in serial mode
INFO : Completed executing command(queryId=hive_20230307174342_be0a401c-ee13-4864-82c6-ef44eb28090f); Time taken: 0.045 seconds
INFO : OK
+-----------+
| tab_name |
+-----------+
| test |
+-----------+
1 row selected (0.29 seconds)
0: jdbc:hive2://cdh002:10000> select * from test;
INFO : Compiling command(queryId=hive_20230307174345_eeccf5a0-2fde-4e6b-bd5e-77ab40b17142): select * from test
INFO : Semantic Analysis Completed
INFO : Returning Hive schema: Schema(fieldSchemas:[FieldSchema(name:test.s1, type:string, comment:null), FieldSchema(name:test.s2, type:string, comment:null)], properties:null)
INFO : Completed compiling command(queryId=hive_20230307174345_eeccf5a0-2fde-4e6b-bd5e-77ab40b17142); Time taken: 0.1 seconds
INFO : Executing command(queryId=hive_20230307174345_eeccf5a0-2fde-4e6b-bd5e-77ab40b17142): select * from test
INFO : Completed executing command(queryId=hive_20230307174345_eeccf5a0-2fde-4e6b-bd5e-77ab40b17142); Time taken: 0.0 seconds
INFO : OK
+----------+----------+
| test.s1 | test.s2 |
+----------+----------+
| a | b |
| 1 | 2 |
+----------+----------+
2 rows selected (0.13 seconds)
登录user_w用户,只能写,不能读
上一篇:dubbo简单入门