开启sentry权限控制hue

参考:

cloudera官方授权：包括webui, ldap,sentry

https://www.cloudera.com/documentation/enterprise/6/6.2/topics/sg_sentry_overview.html

启用sentry

https://cloud.tencent.com/developer/article/1077868

hue中授权:

https://blog.csdn.net/lvtula/article/details/89840097

尹导的:

https://www.cnblogs.com/yinzhengjie/articles/10495217.html

建立数据库:

CREATE DATABASE sentry DEFAULT CHARACTER SET utf8 DEFAULT COLLATE utf8_general_ci;
GRANT ALL ON sentry.* TO 'sentry'@'%' IDENTIFIED BY 'Fengfeng99~';
GRANT ALL ON sentry.* TO 'sentry'@'localhost' IDENTIFIED BY 'Fengfeng99~';

FLUSH PRIVILEGES;

进入CM控制台添加服务:

选择sentry服务

sentry server选数据库所在的node,gateway每个节点都选

输入数据库密码

完成

配置HDFS开启ACLs与sentry权限同步:

配置hive使用sentry服务:

关闭hive的用户模拟功能:

集群未启用安全认证环境下，需要配置以下参数:

检查下yarn的allowed.system.users" 有hive

impala配置使用sentry:

HUE配置使用sentry:

用beeline授权管理用户hive:

https://www.cnblogs.com/hongfeng2019/p/11557524.html

create role admin;
grant all on server server1 to role admin; #如果授权给其它角色,那么拥有此角色的用户将拥有所有库权限
grant role admin to group hive;

用admin帐号登陆HUE建三个帐号:

注意,要先创建组: 例如创建dev3

1/ 先创建dev3的组;

再创建用户:

选dev3的组:

点添加用户:

hue授权hive组为管理员,用hive登陆hue,选安全性

在浏览或roles中把server1的权限授给hive

注意: 开启sentry后/user/hive/warehouse里面的库表数据由sentry权限控制,需要赋予权限后用户才能访问, 如sqoop调用任务,启用的是root,所以需要在beeline里给root赋库的权限.

给用户授URI的访问权限:
https://docs.cloudera.com/documentation/enterprise/6/6.2/topics/impala_authorization.html#sentry_cm

授予URI特权
URI表示您指定为语句一部分的文件路径，例如 创建外部表 和 加载数据。通常，您指定看起来像UNIX路径的路径，但是这些位置也可以加上前缀hdfs：//明确说明它们确实是URI。要为URI设置特权，请指定目录的名称，该特权适用于该目录中的所有文件以及该目录下的所有目录。

URI必须以 hdfs//， s3a//  file:///
例如:
HDFS: hdfs://host:port/path/to/hdfs/table
S3: s3a://host:port/path/to/s3/table

本地:file:///opt/cloudera/parcels

高可用性（HA),则用cluster名:
hdfs://ha-nn-uri/path/to dir

例1: 数仓要运行自己开发的jar包,但发现没有权限

需求是:

create temporary function isInArea_test as 'com.oride.udf.IsInArea' 
USING JAR 'hdfs://warehourse:8020/tmp/udf-1.0-SNAPSHOT-jar-with-dependencies.jar';

1/ 需要hdfs的权限运行jar包

//创建udf hdfs目录role
create role role_udf_hdfs_path;
GRANT ALL ON URI 'hdfs://warehourse:8020/' TO ROLE role_udf_hdfs_path;

2/ udf需要用到本地ufile的jar包

//创建udf 本地目录role
create role role_udf_local_path;
GRANT ALL ON URI 'file:///opt/cloudera/parcels/CDH-6.2.0-1.cdh6.2.0.p0.967373/lib/hive/auxlib/' TO ROLE role_udf_local_path;

例2 给用户s3的访问权限:
方法一: cdh的hdfs添加象/usr/hive/warehouse的前缀,但不支持s3,ufile
https://blog.csdn.net/wflh323/article/details/88891579
sentry
Sentry 同步路径前缀 添加:
ufile://opay-datalake
s3a://opay-bi
https://www.iteye.com/blog/lookqlp-2191087

方法二: grant uri,赋予权限使用户能访问s3的数据,
ufile不支持这种.所以使用公共帐号,把airflow加到admin role.

beeline
!connect jdbc:hive2://localhost:10000
!connect jdbc:hive2://10.52.17.84:10000
mingze.yang

create role s3;
GRANT ALL ON URI 's3a://opay-bi' TO ROLE s3;
create role s3foropay;
GRANT ALL ON URI 's3a://opay-bi/opay' TO ROLE s3;

create role ufile;
GRANT ALL ON URI 'ufile://opay-datalake' TO ROLE ufile;
create role ufile1;
GRANT ALL ON URI 'ufile://opay-datalake/opay/opay' TO ROLE ufile1;

create role sqoop;
GRANT ALL ON URI 'hdfs://warehourse/user/hive/warehouse' TO ROLE sqoop;
grant role sqoop to group root;

create role sqoop2;
GRANT ALL ON URI 'hdfs://10.52.23.195:8020/user/hivewarehouse' TO ROLE sqoop2;
grant role sqoop1 to group root;

DROP ROLE <role name>;

grant role ufile to group `dong.xie`;
grant role ufile to group `mingze.yang`;
grant role ufile1 to group `mingze.yang`;
grant role s3 to group `mingze.yang`;

SHOW ROLE GRANT GROUP `dong.xie`;
SHOW ROLE GRANT GROUP `mingze.yang`;

create role read;
grant select on table test to role read; grant select on table db_test1.users1 to role read;
create role write;
grant insert on table test to role write; grant insert on table db_test1.users1 to role write;
grant role read to group dev1;
grant role write to group dev2;