2

I was reading on that for while using sentry you must disable hive user impersonation.

Is it necessary to disable to impersonation? If Yes is there any other way to impersonate hive user with sentry enabled?

Shashi
  • 2,686
  • 7
  • 35
  • 67

1 Answers1

2

Impersonation and Sentry are two different ways to provide authorization in Hive. First one is based on "POSIX-like" hdfs file system permissions, while Sentry is role-based authorization module + SentryService.

There is no way to use Sentry with impersonation enabled in Hive. It could be a security issue. User/application with granted access to any entity (database, table) stored in hive metadata store could have access to any directory/file on hdfs that doesn't "belong" to him.

According to Cloudera the impersonation is not a recommended way to implement authorization in HiveServer2 (HiveServer2 Impersonation).

Piotr Reszke
  • 1,576
  • 9
  • 21
Artur I
  • 51
  • 4