[HIVE-7361] using authorization api for RESET, DFS, ADD, DELETE, COMPILE commands

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.14.0
• Component/s: Authorization
• Labels: TODOC14

Release Note

This also changes behavior in SQL std auth -
reset command is now allowed.
dfs,add,delete,compile commands are now allowed for the admin user.

• Assignee: Thejas Nair
• Reporter: Thejas Nair
• Created: 07/Jul/14 22:47
• Updated: 13/Nov/14 19:40
• Resolved: 18/Jul/14 18:05

Description

The only way to disable the commands SET, RESET, DFS, ADD, DELETE and COMPILE that is available currently is to use the hive.security.command.whitelist parameter.

Some of these commands are disabled using this configuration parameter for security reasons when SQL standard authorization is enabled. However, it gets disabled in all cases.

If authorization api is used authorize the use of these commands, it will give authorization implementations the flexibility to allow/disallow these commands based on user privileges.

Issue Links

• is related to: HIVE-7456 HIVE-7361 missed updating authorization_fail_8
• links to: review board