[HIVE-7209] allow metastore authorization api calls to be restricted to certain invokers

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.14.0
• Component/s: Authentication, Metastore

Release Note

With this change hive.security.metastore.authorization.manager configuration parameter allows you to specify more than one authorization manager class (comma separated).

This patch introduces a new authorization manager for use under this configuration - org.apache.hadoop.hive.ql.security.authorization.MetaStoreAuthzAPIAuthorizerEmbedOnly. It will disallow any of the authorization api calls to be invoked in a remote metastore.
HiveServer2 can be configured to use embedded metastore, and that will allow it to invoke metastore authorization api. Hive cli and any other remote metastore users would be denied authorization when they try to make authorization api calls. This allows restricting the authorization api use to privileged HiveServer2 process.

• Assignee: Thejas Nair
• Reporter: Thejas Nair
• Created: 10/Jun/14 23:48
• Updated: 11/Jan/15 08:37
• Resolved: 03/Jul/14 21:44

Description

Any user who has direct access to metastore can make metastore api calls that modify the authorization policy.
The users who can make direct metastore api calls in a secure cluster configuration are usually the 'cluster insiders' such as Pig and MR users, who are not (securely) covered by the metastore based authorization policy. But it makes sense to disallow access from such users as well.

Issue Links

• is related to: HIVE-7759 document hive cli authorization behavior when SQL std auth is enabled
• links to: review board