HADOOP docker(七):hive权限管理

-hiveconf hive.security.authorization.manager=org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLStdHiveAuthorizerFactory
-hiveconf hive.security.authorization.enabled=true
-hiveconf hive.security.authenticator.manager=org.apache.hadoop.hive.ql.security.SessionStateUserAuthenticator
-hiveconf hive.metastore.uris=‘ ‘

<property>
  <name>hive.security.authorization.enabled</name> 
  <value>true</value>
  <description>hive是否开启客户端认证，默认是false</description>
</property>
<property>
  <name>hive.security.authorization.createtable.owner.grants</name>
  <value>ALL</value>
  <description>创建表和用户是否拥有该的权限，默认为空，即创建者也没有该表的读写权限。 可以设置all select drop等</description>
</property>
<property>
  <name>hive.security.authorization.createtable.user.grants</name>
  <value>ALL</value>
  <description> 创建表后是否对特定用户权限，默认为空；如可以权限： irwin,hadoop:select;tom:create </description>
</property>
<property>
  <name>hive.security.authorization.createtable.role.grants</name>
  <value>ALL</value>
  <description>当表创建时自动授权给特定角色权限，默认是空；</description>
</property>
<property>
  <name>hive.security.authorization.task.factory</name>
  <value>org.apache.hadoop.hive.ql.parse.authorization.HiveAuthorizationTasFactoryImpl</value>
  <description> 覆盖默认的权限设置hive.security.authorization.task.factory DDL操作，一个实现接口的org.apache.hadoop.hive.ql.parse.authorization.hiveauthorizationtaskfactory</description>
</property>
<property>
  <name>hive.security.command.whitelist</name>
  <value>set</value>
  <description>hive授权用户执行的非SQL命令列表，用都好分隔。默认是set,reset,dfs,add,delete。就是hive授权用户可以执行的非sql命令。
</description>
</property>
<property>
  <name>hive.conf.restricted.list</name>
  <value>hive.security.authorization.manager,hive.security.authenticator.manager,hive.users.in.admin.role</value>
  <description>上面的属性值是限制修改的，即如果不从本属性列表中删除，在命令台reset无效</description>
</property>

package com.ganymede.hiveauth;  
import org.apache.hadoop.hive.ql.parse.ASTNode;  
import org.apache.hadoop.hive.ql.parse.AbstractSemanticAnalyzerHook;  
import org.apache.hadoop.hive.ql.parse.HiveParser;  
import org.apache.hadoop.hive.ql.parse.HiveSemanticAnalyzerHookContext;  
import org.apache.hadoop.hive.ql.parse.SemanticException;  
import org.apache.hadoop.hive.ql.session.SessionState;  

/** 
 * Created by Ganymede on 2016/10/4. 
 */  
public class MyAuthHook extends AbstractSemanticAnalyzerHook {  
    private static String[] admin = {"root", "hadoop", "hive"};  //配置Hive管理员  

    @Override  
    public ASTNode preAnalyze(HiveSemanticAnalyzerHookContext context,  
                              ASTNode ast) throws SemanticException {  
        switch (ast.getToken().getType()) {  
            case HiveParser.TOK_CREATEDATABASE:  
            case HiveParser.TOK_DROPDATABASE:  
            case HiveParser.TOK_CREATEROLE:  
            case HiveParser.TOK_DROPROLE:  
            case HiveParser.TOK_GRANT:  
            case HiveParser.TOK_REVOKE:  
            case HiveParser.TOK_GRANT_ROLE:  
            case HiveParser.TOK_REVOKE_ROLE:  
                String userName = null;  
                if (SessionState.get() != null  
                        && SessionState.get().getAuthenticator() != null) {  
                    userName = SessionState.get().getAuthenticator().getUserName();  
                }  
                if (!admin[0].equalsIgnoreCase(userName)  
                        && !admin[1].equalsIgnoreCase(userName) && !admin[2].equalsIgnoreCase(userName)) {  
                    throw new SemanticException(userName  
                            + " can‘t use ADMIN options, except " + admin[0] + "," + admin[1] + ","  
                            + admin[2] + ".");  
                } 
                break;  
            default:  
                break;  
        }  
        return ast;  
    }  

    public static void main(String[] args) throws SemanticException {  
        String[] admin = {"admin", "root"};  
        String userName = "root1";  
        for (String tmp : admin) {  
            System.out.println(tmp);  
            if (!admin[0].equalsIgnoreCase(userName) && !admin[1].equalsIgnoreCase(userName)) {  
                throw new SemanticException(userName  
                        + " can‘t use ADMIN options, except " + admin[0] + ","  
                        + admin[1] + ".");  
            }  
        }  
    }  
}   

<!-- 配置对hiveserver2生效-->
<property>
    <name>hive.aux.jars.path</name>
    <value>file:///opt/mllib/hive-app.jar</value>
</property>
<!-- 设置超级用户类-->
<property>
    <name>hive.semantic.analyzer.hook</name>
    <value>com.ganymede.hiveauth.MyAuthHook</value>
</property>

<property>
  <name>hive.server2.authentication</name>
  <value>CUSTOM</value>
  <description>安全验证方式，默认NONE，可选的包括 OSASL、KERBEROS、LDAP、PAM和CUSTOM等</description>
</property>
<property>
  <name>hive.server2.custom.authentication.class</name>
  <value>com.bqjr.bigdata.hive.hiveserver2.CustomHiveServer2Auth</value>
  <description>实现自定义，实现hiveserver2登录密码校验</description>
</property>
<property>
  <name>hive.server2.custom.authentication.file</name>
  <value>/usr/local/hiveserver2/hive.server2.users.conf</value>
  <description>hiveserver2用户名密码文件</description>
</property>

package com.bqjr.bigdata.hive.hiveserver2;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hive.service.auth.PasswdAuthenticationProvider;

import javax.security.sasl.AuthenticationException;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.IOException;

/**
 * Created by jian.zhang02 on 2016/12/21.
 */
public class CustomHiveServer2Auth   implements PasswdAuthenticationProvider{
    @Override
    public void Authenticate(String username, String password) throws AuthenticationException {
        boolean ok = false;
        String passMd5 = new MD5().md5(password);
        HiveConf hiveConf = new HiveConf();
        Configuration conf = new Configuration(hiveConf);
        String filePath = conf.get("hive.server2.custom.authentication.file");
        System.out.println("hive.server2.custom.authentication.file [" + filePath + "] ..");
        File file = new File(filePath);
        BufferedReader reader = null;
        try {
            reader = new BufferedReader(new FileReader(file));
            String tempString = null;
            while ((tempString = reader.readLine()) != null) {
                String[] datas = tempString.split(",", -1);
                if(datas.length != 2) continue;
                //ok
                if(datas[0].equals(username) && datas[1].equals(passMd5)) {
                    ok = true;
                    break;
                }
            }
            reader.close();
        } catch (Exception e) {
            e.printStackTrace();
            throw new AuthenticationException("read auth config file error, [" + filePath + "] ..", e);
        } finally {
            if (reader != null) {
                try {
                    reader.close();
                } catch (IOException e1) {}
            }
        }
        if(ok) {
            System.out.println("user [" + username + "] auth check ok .. ");
        } else {
            System.out.println("user [" + username + "] auth check fail .. ");
            throw new AuthenticationException("user [" + username + "] auth check fail .. ");
        }
    }
}

CREATE ROLE role_name
DROP ROLE role_name

GRANT ROLE role_name [, role_name] …
TO principal_specification [, principal_specification] …
[WITH ADMIN OPTION]

REVOKE [ADMIN OPTION FOR] ROLE role_name [, role_name] …
FROM principal_specification [, principal_specification] …

principal_specification:
    USER user
  | GROUP group
  | ROLE role

SHOW ROLE GRANT principal_specification

principal_specification:
    USER user
  | GROUP group
  | ROLE role

GRANT
    priv_type [(column_list)]
      [, priv_type [(column_list)]] …
    [ON object_specification]
    TO principal_specification [, principal_specification] …
    [WITH GRANT OPTION]

REVOKE [GRANT OPTION FOR]
    priv_type [(column_list)]
      [, priv_type [(column_list)]] …
    [ON object_specification]
    FROM principal_specification [, principal_specification] …

REVOKE ALL PRIVILEGES, GRANT OPTION
    FROM user [, user] …

priv_type:
    ALL | ALTER | UPDATE | CREATE | DROP
  | INDEX | LOCK | SELECT | SHOW_DATABASE 

object_specification:
    TABLE tbl_name
  | DATABASE db_name

principal_specification:
    USER user
  | GROUP group
  | ROLE role

SHOW GRANT principal_specification
[ON object_specification [(column_list)]]

principal_specification:
    USER user
  | GROUP group
  | ROLE role

object_specification:
    TABLE tbl_name
  | DATABASE db_name