[HIVE-8045] SQL standard auth with cli - Errors and configuration issues

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.14.0
• Component/s: Authorization
• Assignee: Thejas Nair
• Reporter: Jagruti Varia
• Created: 10/Sep/14 22:11
• Updated: 13/Nov/14 19:40
• Resolved: 23/Sep/14 20:42

Description

HIVE-7533 enabled sql std authorization to be set in hive cli (without enabling authorization checks). This updates hive configuration so that create-table and create-views set permissions appropriately for the owner of the table.
HIVE-7209 added a metastore authorization provider that can be used to restricts calls made to the authorization api, so that only HS2 can make those calls (when HS2 uses embedded metastore).

Some issues were found with this.

1. Even if hive.security.authorization.enabled=false, authorization checks were happening for non sql statements as add/detete/dfs/compile, which results in MetaStoreAuthzAPIAuthorizerEmbedOnly throwing an error.
2. Create table from hive-cli ended up calling metastore server api call (getRoles) and resulted in MetaStoreAuthzAPIAuthorizerEmbedOnly throwing an error.
3. Some users prefer to enable authorization using hive-site.xml for hive-server2 (hive.security.authorization.enabled param). If this file is shared by hive-cli and hive-server2, SQL std authorizer throws an error because is use in hive-cli is not allowed.

Issue Links

• is related to: HIVE-7759 document hive cli authorization behavior when SQL std auth is enabled
• links to: review board