[HIVE-14099] Hive security authorization can be disabled by users

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.13.1
• Fix Version/s: 2.3.0
• Component/s: Authorization
• Assignee: Aihua Xu
• Reporter: Prashant Kumar Singh
• Created: 27/Jun/16 09:59
• Updated: 21/Jul/17 17:55
• Resolved: 05/Oct/16 14:25

Description

In case we enables :

hive.security.authorization.enabled=true in hive-site.xml

this setting can be disabled by users at their hive prompt. There should be hardcoded setting in the configs.

The other thing is once we enable authorization, the tables that got created before enabling looses access as they don't have authorization defined. How this situation can be tackled in hive.

Note that this issue does not affect SQL standard or ranger authorization plugin.

Issue Links

• relates to: HIVE-5953 SQL std auth - authorize grant/revoke on table
• relates to: HIVE-13853 Add X-XSRF-Header filter to HS2 HTTP mode and WebHCat
• relates to: HIVE-6437 DefaultHiveAuthorizationProvider should not initialize a new HiveConf