[HIVE-20457] Create authorization mechanism for granting/revoking privileges to change Hive properties

• Type: Improvement
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Component/s: Security
• Labels: authorization
• Assignee: Oleksiy Sayankin
• Reporter: Oleksiy Sayankin
• Created: 24/Aug/18 10:10
• Updated: 24/Aug/18 15:53

Description

At the moment any user in Hive can change any property of Hive. So he can set hive.exec.pre.hooks to hook that implements dangerous code. It would be nice to create roles and assign list of properties that particular role is able to modify. For example, admin role has permissions to change any property, and hive_client can change only hive.txn.timeout.