问题
I'm experimenting with HDP2.2 cluster with Ambari setup on CentOS 6.5 and I have problems with running Hive GRANT queries. For example, a query
grant select on Tbl1 to user root;
gives me an exception that looks like that
FAILED: Execution Error, return code 1 from org.apache.hadoop.hive.ql.exec.DDLTask. Failed to retrieve roles for hdfs: Metastore Authorization api invocation for remote metastore is disabled in this configuration.
What's going on here and could you explain the meaning of 'retrieve roles for hdfs'? Is that a 'hdfs' system user or some specific hadoop user?
From what i've been reading, it seems that problem is with some hive settings. Is there a way to turn security off somehow or tweak it in a right way using hive-site.xml ?
回答1:
Below are the setting in your hive-site.xml?
hive.security.metastore.authorization.manager org.apache.hadoop.hive.ql.security.authorization.StorageBasedAuthorizationProvider,org.apache.hadoop.hive.ql.security.authorization.MetaStoreAuthzAPIAuthorizerEmbedOnly
This will restrict any Grant/Revoke statements through beeline/hive-server2 interface only.
Setting "MetaStoreAuthzAPIAuthorizerEmbedOnly" is in addition to "StorageBasedAuthorizationProvider" and its sole purpose is to disable grant/revoke through hive-cli. To use SQL authorization fully, this setting gives single point of control for providing SQL based authorization. If you remove this setting, anybody from Hive-CLI can set him/herself admin and bypass SQL-based privileges.
来源：https://stackoverflow.com/questions/29206980/grant-permissions-in-hive-does-not-work-on-hdp2-2