6.7. Hive Security Configuration

• Authorization
• Authentication
• Kerberos Support
• End User Impersonation
• Additional Information About Keytab Files
• File Based Authorization

Authorization

You can enable authorization checks for the Hive Connector by settingthe hive.security property in the Hive catalog properties file. Thisproperty must be one of the following values:

SQL Standard Based Authorization

When sql-standard security is enabled, Presto enforces the same SQLstandard based authorization as Hive does.

Since Presto’s ROLE syntax support matches the SQL standard, andHive does not exactly follow the SQL standard, there are the followinglimitations and differences:

• CREATE ROLE role WITH ADMIN is not supported.
• The admin role must be enabled to execute CREATE ROLE or DROP ROLE.
• GRANT role TO user GRANTED BY someone is not supported.
• REVOKE role FROM user GRANTED BY someone is not supported.
• By default, all a user’s roles except admin are enabled in a new user session.
• One particular role can be selected by executing SET ROLE role.
• SET ROLE ALL enables all of a user’s roles except admin.
• The admin role must be enabled explicitly by executing SET ROLE admin.

Authentication

The default security configuration of the Hive Connector does not useauthentication when connecting to a Hadoop cluster. All queries are executed asthe user who runs the Presto process, regardless of which user submits thequery.

The Hive connector provides additional security options to support Hadoopclusters that have been configured to use Kerberos.

When accessing HDFS, Presto canimpersonate the end user who is running thequery. This can be used with HDFS permissions and ACLs to provide additional security for data.

Warning

Access to the Presto coordinator should be secured using Kerberos when usingKerberos authentication to Hadoop services. Failure to secure access to thePresto coordinator could result in unauthorized access to sensitive data onthe Hadoop cluster.

See Coordinator Kerberos Authentication and CLI Kerberos Authenticationfor information on setting up Kerberos authentication.

Kerberos Support

In order to use the Hive connector with a Hadoop cluster that uses kerberosauthentication, you will need to configure the connector to work with twoservices on the Hadoop cluster:

• The Hive metastore Thrift service
• The Hadoop Distributed File System (HDFS)

hive.metastore.authentication.type=NONE

hive.metastore.authentication.type=KERBEROS
hive.metastore.service.principal=hive/hive-metastore-host.example.com@EXAMPLE.COM
hive.metastore.client.principal=presto@EXAMPLE.COM
hive.metastore.client.keytab=/etc/presto/hive.keytab

hive.hdfs.authentication.type=NONE

hive.hdfs.authentication.type=KERBEROS
hive.hdfs.presto.principal=hdfs@EXAMPLE.COM
hive.hdfs.presto.keytab=/etc/presto/hdfs.keytab

hive.hdfs.authentication.type=NONE
hive.hdfs.impersonation.enabled=true

hive.hdfs.authentication.type=KERBEROS
hive.hdfs.impersonation.enabled=true
hive.hdfs.presto.principal=presto@EXAMPLE.COM
hive.hdfs.presto.keytab=/etc/presto/hdfs.keytab

• user (optional): regex to match against user name.
• schema (optional): regex to match against schema name.
• owner (required): boolean indicating ownership.

Table Rules

These rules govern the privileges granted on specific tables.

• user (optional): regex to match against user name.
• schema (optional): regex to match against schema name.
• table (optional): regex to match against table name.
• privileges (required): zero or more of SELECT, INSERT,DELETE, OWNERSHIP, GRANT_SELECT.

Session Property Rules

These rules govern who may set session properties.

• user (optional): regex to match against user name.
• property (optional): regex to match against session property name.
• allowed (required): boolean indicating whether this session property may be set.

{
  "schemas": [
    {
      "user": "admin",
      "schema": ".*",
      "owner": true
    },
    {
      "user": "guest",
      "owner": false
    },
    {
      "schema": "default",
      "owner": true
    }
  ],
  "tables": [
    {
      "user": "admin",
      "privileges": ["SELECT", "INSERT", "DELETE", "OWNERSHIP"]
    },
    {
      "user": "banned_user",
      "privileges": []
    },
    {
      "schema": "default",
      "table": ".*",
      "privileges": ["SELECT"]
    }
  ],
  "sessionProperties": [
    {
      "property": "force_local_scheduling",
      "allow": true
    },
    {
      "user": "admin",
      "property": "max_split_size",
      "allow": true
    }
  ]
}

HDFS wire encryption

In a Kerberized Hadoop cluster with enabled HDFS wire encryption you can enablePresto to access HDFS by using below property.

Note

Depending on Presto installation configuration, using wire encryption mayimpact query execution performance.