参考:
cloudera官方授权：包括webui, ldap,sentry
https://www.cloudera.com/documentation/enterprise/6/6.2/topics/sg_sentry_overview.html
启用sentry
https://cloud.tencent.com/developer/article/1077868
hue中授权:
https://blog.csdn.net/lvtula/article/details/89840097
尹导的:
https://www.cnblogs.com/yinzhengjie/articles/10495217.html
建立数据库:
CREATE DATABASE sentry DEFAULT CHARACTER SET utf8 DEFAULT COLLATE utf8_general_ci;
GRANT ALL ON sentry.* TO 'sentry'@'%' IDENTIFIED BY 'Fengfeng99~';
GRANT ALL ON sentry.* TO 'sentry'@'localhost' IDENTIFIED BY 'Fengfeng99~';
FLUSH PRIVILEGES;
进入CM控制台添加服务:
选择sentry服务
sentry server选数据库所在的node,gateway每个节点都选
输入数据库密码
完成
配置HDFS开启ACLs与sentry权限同步:
配置hive使用sentry服务:
关闭hive的用户模拟功能:
集群未启用安全认证环境下，需要配置以下参数:
检查下yarn的allowed.system.users" 有hive
impala配置使用sentry:
HUE配置使用sentry:
用beeline授权管理用户hive:
https://www.cnblogs.com/hongfeng2019/p/11557524.html
create role admin;
grant all on server server1 to role admin; #如果授权给其它角色,那么拥有此角色的用户将拥有所有库权限
grant role admin to group hive;
用admin帐号登陆HUE建三个帐号:
注意,要先创建组: 例如创建dev3
1/ 先创建dev3的组;
再创建用户:
选dev3的组:
点添加用户:
hue授权hive组为管理员,用hive登陆hue,选安全性
在浏览或roles中把server1的权限授给hive
注意: 开启sentry后/user/hive/warehouse里面的库表数据由sentry权限控制,需要赋予权限后用户才能访问, 如sqoop调用任务,启用的是root,所以需要在beeline里给root赋库的权限.
给用户授URI的访问权限:
https://docs.cloudera.com/documentation/enterprise/6/6.2/topics/impala_authorization.html#sentry_cm
授予URI特权
URI表示您指定为语句一部分的文件路径，例如 创建外部表 和 加载数据。通常，您指定看起来像UNIX路径的路径，但是这些位置也可以加上前缀hdfs：//明确说明它们确实是URI。要为URI设置特权，请指定目录的名称，该特权适用于该目录中的所有文件以及该目录下的所有目录。
URI必须以 hdfs//， s3a// file:///
例如:
HDFS: hdfs://host:port/path/to/hdfs/table
S3: s3a://host:port/path/to/s3/table
本地:file:///opt/cloudera/parcels
高可用性（HA),则用cluster名:
hdfs://ha-nn-uri/path/to dir
例1: 数仓要运行自己开发的jar包,但发现没有权限
需求是:
create temporary function isInArea_test as 'com.oride.udf.IsInArea'
USING JAR 'hdfs://warehourse:8020/tmp/udf-1.0-SNAPSHOT-jar-with-dependencies.jar';
1/ 需要hdfs的权限运行jar包
//创建udf hdfs目录role
create role role_udf_hdfs_path;
GRANT ALL ON URI 'hdfs://warehourse:8020/' TO ROLE role_udf_hdfs_path;
2/ udf需要用到本地ufile的jar包
//创建udf 本地目录role
create role role_udf_local_path;
GRANT ALL ON URI 'file:///opt/cloudera/parcels/CDH-6.2.0-1.cdh6.2.0.p0.967373/lib/hive/auxlib/' TO ROLE role_udf_local_path;
例2 给用户s3的访问权限:
方法一: cdh的hdfs添加象/usr/hive/warehouse的前缀,但不支持s3,ufile
https://blog.csdn.net/wflh323/article/details/88891579
sentry
Sentry 同步路径前缀 添加:
ufile://opay-datalake
s3a://opay-bi
https://www.iteye.com/blog/lookqlp-2191087
方法二: grant uri,赋予权限使用户能访问s3的数据,
ufile不支持这种.所以使用公共帐号,把airflow加到admin role.
beeline
!connect jdbc:hive2://localhost:10000
!connect jdbc:hive2://10.52.17.84:10000
mingze.yang
create role s3;
GRANT ALL ON URI 's3a://opay-bi' TO ROLE s3;
create role s3foropay;
GRANT ALL ON URI 's3a://opay-bi/opay' TO ROLE s3;
create role ufile;
GRANT ALL ON URI 'ufile://opay-datalake' TO ROLE ufile;
create role ufile1;
GRANT ALL ON URI 'ufile://opay-datalake/opay/opay' TO ROLE ufile1;
create role sqoop;
GRANT ALL ON URI 'hdfs://warehourse/user/hive/warehouse' TO ROLE sqoop;
grant role sqoop to group root;
create role sqoop2;
GRANT ALL ON URI 'hdfs://10.52.23.195:8020/user/hivewarehouse' TO ROLE sqoop2;
grant role sqoop1 to group root;
DROP ROLE <role name>;
grant role ufile to group `dong.xie`;
grant role ufile to group `mingze.yang`;
grant role ufile1 to group `mingze.yang`;
grant role s3 to group `mingze.yang`;
SHOW ROLE GRANT GROUP `dong.xie`;
SHOW ROLE GRANT GROUP `mingze.yang`;
create role read;
grant select on table test to role read; grant select on table db_test1.users1 to role read;
create role write;
grant insert on table test to role write; grant insert on table db_test1.users1 to role write;
grant role read to group dev1;
grant role write to group dev2;