Sentry权限赋权示例

• 连接sentry 使用beeline

[root@host1 ~]# beeline -u "jdbc:hive2://host1:10000/" -n hive -p hive -d org.apache.hive.jdbc.HiveDriver
Connecting to jdbc:hive2://host1:10000/
Connected to: Apache Hive (version 1.1.0-cdh5.10.2)
Driver: Hive JDBC (version 1.1.0-cdh5.10.2)
Transaction isolation: TRANSACTION_REPEATABLE_READ
Beeline version 1.1.0-cdh5.10.2 by Apache Hive

• 创建一个管理员角色

0: jdbc:hive2://host1:10000/> create role admin_role;

INFO  : Completed executing command(queryId=hive_20181211171616_a8881629-e172-449b-aee2-edd59e6d5470); Time taken: 0.649 seconds
INFO  : OK
No rows affected (1.356 seconds)

• 给管理员角色 赋予所有的权限

0: jdbc:hive2://host1:10000/> GRANT ALL ON SERVER server1 TO ROLE admin_role;
INFO  : Compiling command(queryId=hive_20181211171717_3fae6e7b-6f29-4205-8e69-e2686b0bf7b5): GRANT ALL ON SERVER server1 TO ROLE admin_role
...
INFO  : OK
No rows affected (0.927 seconds)

• 将管理员角色分配给组admin ，这里的admin组是是linux的用户组

0: jdbc:hive2://host1:10000/> GRANT ROLE admin_role TO GROUP admin;
INFO  : Compiling command(queryId=hive_20181211171717_65c165b1-7bf6-4b76-9435-4fce1d372e7f): GRANT ROLE admin_role TO GROUP admin
...
No rows affected (0.481 seconds)

• 创建一个测试角色

0: jdbc:hive2://host1:10000/> create role test_role;
INFO  : Compiling command(queryId=hive_20181211171919_c21ed11e-eec2-4096-b9e8-6af11aa11482): create role test_role
...
INFO  : OK
No rows affected (0.445 seconds)

• 将数据库 hx的所有赋予test_role

0: jdbc:hive2://host1:10000/>  grant all on database hx to ROLE test_role
INFO  : Compiling command(queryId=hive_20181211172020_89583d38-3ba9-416f-bac0-69b9d85c781d): GRANT ALL ON DATABASE hx TO ROLE test_role
...
INFO  : OK
No rows affected (0.546 seconds)

• 将角色test_role分配给hx组用户 ，group hx 是linux用户组

0: jdbc:hive2://host1:10000/> GRANT ROLE test_role TO GROUP hx ;
INFO  : Compiling command(queryId=hive_20181211172828_6c80e4df-2571-42da-ba7d-16f4145b486f): GRANT ROLE test_role TO GROUP hx 
...
INFO  : OK
No rows affected (0.73 seconds)

• 将risk_dw 库的 select 权限赋予test_role组

0: jdbc:hive2://host1:10000/> GRANT select ON DATABASE risk_dw TO ROLE test_role;
INFO  : Compiling command(queryId=hive_20181211173838_21942bf7-8daf-4201-9048-e1c7aba5fe71): GRANT select ON DATABASE risk_dw TO ROLE test_role
...
INFO  : OK
No rows affected (0.77 seconds)
0: jdbc:hive2://host1:10000/> 

• 将risk_dw 库的 select 从角色test_role中收回，使用revoke关键字
• REVOKE
  (PRIVILEGE) [, (PRIVILEGE) ]
  ON (OBJECT) (object_name)
  FROM ROLE (roleName) [,ROLE (roleName)]

0: jdbc:hive2://host1:10000/> REVOKE select ON DATABASE risk_dw from ROLE test_role;
INFO  : Compiling command(queryId=hive_20181211173838_21942bf7-8daf-4201-9048-e1c7aba5fe71): REVOKE select ON DATABASE risk_dw from ROLE test_role;
...
INFO  : OK
No rows affected (0.77 seconds)
0: jdbc:hive2://host1:10000/>