[IMPALA-1967] On Sentry enabled impala 2.1.3, one join order throws ERROR: AuthorizationException: User 'xx' does not have privileges to access: databse_yy

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: Impala 2.1.2
• Fix Version/s: Impala 2.3.0
• Labels: security
• Assignee: Dimitris Tsirogiannis
• Reporter: Mala Chikka Kempanna
• Created: 28/Apr/15 22:29
• Updated: 14/May/15 20:59
• Resolved: 14/May/15 20:59

Description

The following query returns results
1.
select h.dealer_code from view1 h left outer join view2 i on h.dealer_code = i.dealer_code limit 5;

But the same query with reversed tables order, throws authorization error

2.
select h.dealer_code from view2 h left outer join view1 i on h.dealer_code = i.dealer_code limit 5;
ERROR: AuthorizationException: User 'xx' does not have privileges to access: databse_yy

On checking the logs, it's seen that impala is trying to get write access on the source database databse_yy on which these views are built.

Impala should not need write access to database to just join the views.