[AMBARI-5289] HiveServer2 default security configuration changes

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.5.0
• Fix Version/s: 1.5.1
• Component/s: ambari-server
• Assignee: Dmytro Sen
• Reporter: Dmytro Sen
• Created: 31/Mar/14 15:37
• Updated: 06/Apr/14 21:22
• Resolved: 06/Apr/14 21:22

Description

1.
For hive server2 startup commandline option, ambari should specify the following configuration values:
-hiveconf hive.security.authorization.manager=org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLStdHiveAuthorizerFactory
-hiveconf hive.security.authorization.enabled=true
-hiveconf hive.security.authenticator.manager=org.apache.hadoop.hive.ql.security.SessionStateUserAuthenticator.
2.
Ambari has been specifying the config hive.metastore.uris="" . It would be better to stop specifying this. With changes in hive security, there is some overhead of using embedded metastore from hive-server2.
3.
There is a new config parameter "hive.users.in.admin.role" that is important to security. If user is specified as value of this config, that user has superuser privileges (meant for a user playing the DBA role).
This should be set in hive-site.xml (used by metastore server). If it's set a default admin for any other service we can do the same here.

Issue Links

• links to: Review Board