[HIVE-21833] Ranger Authorization in Hive based on object ownership

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0-alpha-1
• Component/s: HiveServer2
• Target Version/s: 4.0.0
• Hadoop Flags: Reviewed
• Assignee: Sam An
• Reporter: Sam An
• Due: 15/Jun/19
• Created: 04/Jun/19 17:43
• Updated: 17/Nov/22 08:50
• Resolved: 17/Jun/19 23:08

Description

Background: Currently Hive Authorizer for Ranger does not provide owner information for Hive objects as part of AuthZ calls. This has resulted in gaps with respect to Sentry AuthZ and customers/partners cannot leverage privileges for owners in their authorization model.

 

User Story: As an enterprise security admin, I need to be able to set privileges based on Hive object ownership for setting up access controls in Ranger so that I can provide appropriate protections and permissions for my enterprise users.

 

Acceptance criteria:

1) Owner information is available in Hive -Ranger AuthZ calls 

2) Ranger admin users can use owner information to set policies based on object ownership in Ranger UI and APIs

3) OWNER Macro based policies continue to work for Hive objects

Issue Links

• links to: pull request for Hive-21833