[HIVE-2241] Thrift MetaStore interface bypasses authorization checks

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: Authorization, JDBC, Metastore, ODBC, Security
• Assignee: Enis Soztutar
• Reporter: Carl Steinbach
• Created: 27/Jun/11 17:01
• Updated: 26/Sep/12 02:10

Description

Hive's authorization mechanism works with DML and DDL statements only. Authorization checks are not applied when a Thrift client directly accesses the Metastore's Thrift interface, e.g. create_table(), drop_table(), alter_table(), get_databases(), get_tables(), etc.

Catalog functions such as get_databases() and get_tables() are directly accessed by JDBC and ODBC drivers.

Issue Links

• is duplicated by: HIVE-2876 Need more server side authorization for Hive Metastore operations
• is related to: HCATALOG-244 Security in Hcat

Sub-Tasks

• Move retry logic in HiveMetaStore to a separe class: Closed
• Merge MetaStoreListener and HiveMetaHook interfaces: Open