E-MapReduce:DLF-Auth

Prerequisites

Limits

• Data Lake Formation (DLF) permission management is supported only for Resource Access Management (RAM) users. You can add users on the user management page in the EMR console.

• For information about the regions that support the data permission management feature of Data Lake Formation (DLF), see Supported regions and endpoints.

• If you enable Hive or Spark for DLF-Auth, you cannot enable or disable them for Ranger, and vice versa.

• The following table lists the EMR versions and compute engines that DLF-Auth supports.

  EMR major version		Hive	Spark	Presto	Impala
  EMR 3.x	EMR 3.39.0 and earlier	Not supported	Not supported	Not supported	Not supported
  	EMR-3.40.0	Supported	Supported	Supported	Not supported
  	EMR 3.41.0 to EMR 3.43.1	Supported	Supported	Not supported	Not supported
  	EMR 3.44.0 and later	Supported	Supported	Supported	Supported
  EMR 5.x	EMR 5.5.0 and earlier	Not supported	Not supported	Not supported	Not supported
  	EMR 5.6.0	Supported	Support	Supported	Not supported
  	EMR 5.7.0 to EMR 5.9.1	Supported	Supported	Not supported	Not supported
  	EMR 5.10.0 and later	Supported	Supported	Supported	Supported

Procedure

Follow these steps to enable DLF-Auth and implement fully managed, unified permission management for your data lake.

Step 1: Enable Hive access control

1. Go to the DLF-Auth page.

   1. Log on to EMR on ECS.

   2. In the top navigation bar, select a region and resource group as needed.

   3. On the EMR on ECS page, find the cluster that you want to manage and click Services in the Actions column.

   4. On the Services page, click Status in the DLF-Auth service section.

2. Enable Hive access control.

   1. On the DLF-Auth service page, turn on the enableHive switch.

   2. In the dialog box that appears, click OK.

3. Restart HiveServer.

   1. On the Services page, click the Hive service.

   2. On the Hive service page, find HiveServer and click Restart in the Actions column.

   3. In the dialog box that appears, enter an Execution Reason and click OK.

   4. In the Confirm dialog box, click OK.

Step 2: Add a RAM user

Add a user using the user management feature.

1. Go to the User Management page.

   1. Log on to EMR on ECS.

   2. In the top navigation bar, select a region and resource group as needed.

   3. On the EMR on ECS page, find the cluster that you want to manage and click Services in the Actions column.

   4. Click the Users tab.

2. On the Users page, click Add User.

3. In the Add User dialog box, select an existing RAM user from the Username drop-down list to use as the EMR username. Then, enter a password in the Password and Confirm Password fields.

4. Click OK.

Step 3: Validate permissions

1. Validate the permissions of the current user before you grant new permissions.

   1. Log on to the cluster using the Secure Shell (SSH) protocol. For more information, see Log on to a cluster.

   2. Run the following command to access HiveServer2.

      beeline -u jdbc:hive2://master-1-1:10000 -n <user> -p <password>

      Note

      <user> and <password> represent the username and password that you set in Step 2: Add a RAM user.

   3. View information about an existing table.

      For example, run the following command to view information about the test table. Replace testdb.test with your actual information.

      select * from testdb.test;

      Because the current user does not have the required permissions, the query fails and a permission error is returned.

      0: jdbc:hive2://xxx:10000> select * from testdb.test;
      22/07/07 19:03:32 [main]: WARN conf.HiveConf: HiveConf of name hive.metastore.delta.compatible.mode.enabled does not e
      xist
      Error: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [dlf-test] does not
       have [SELECT] privilege on [database=testdb/table=test/*]. Permission denied: DLF checkPermission failed. message=[Ac
      tion: CHECK_PERMISSIONS ErrorCode: NoPermission Message: Authorization Failed [4019], You have NO privilege 'Select' o
      n {acs:dlf:cn-hangzhou:xxx:metastore/catalogs/xxx/databases/testdb/tables/test}. Deny as def
      ault for Resource.  Context ID:dd198392-9b30-4899-9b32-61e1a993bd55.    --->Tips: Principal:acs:ram::xxx:
      user/dlf-test Not pass by dlf permission check. RequestId: C4EC27BE-31ED-5A4B-AD40-2C8EF60359C0] (state=42000,code=400
      00)

2. Add permissions for the RAM user.

   1. Log on to the Data Lake Formation console.

   2. In the navigation pane on the left, choose Data Permission > Grant Permissions.

   3. On the Grant Permissions page, click Add Authorization.

   4. On the Add Authorization page, configure the following parameters.

      Parameter		Description
      Principal	Principal Type	The default is RAM User.
      	Choose Principal	From the Choose Principal drop-down list, select the user you added in Step 2: Add a RAM user.
      Resources	Authorization Method	The default is Resource-based authorization.
      	Resource Type	Select the appropriate option. In this example, Metadata Table is selected.
      Permission	Data Permission	In this example, Select is used.
      	Permissions

   5. Click OK.

3. Validate the permissions of the current user after you grant new permissions.

   Follow the instructions in Substep a of Step 1 to view the table information again. Because the required permission is granted, the query now returns information about the table.

(Optional) Step 4: Enable Hive LDAP authentication

If you enable DLF-Auth permissions, you should also enable Hive LDAP authentication. This ensures that users who connect to Hive are authenticated by LDAP before they can run scripts.

1. Go to the Cluster Services page.

   1. Log on to EMR on ECS.

   2. In the top navigation bar, select a region and resource group as needed.

   3. On the EMR on ECS page, find the cluster that you want to manage and click Services in the Actions column.

2. Enable LDAP authentication.

   1. On the Services page, click Status in the Hive service section.

   2. Turn on the enableLDAP switch.

      • For EMR 5.11.1 or later and EMR 3.45.1 or later

        1. In the Service Overview section, turn on the enableLDAP switch.

        2. In the dialog box that appears, click OK.

      • For EMR 5.11.0 or earlier and EMR 3.45.0 or earlier

        1. In the Components section, find HiveServer and choose > enableLDAP in the Actions column.

        2. In the dialog box that appears, enter an Execution Reason and click OK.

        3. In the Confirm dialog box, click OK.

   3. Restart HiveServer.

      1. In the Components section, find HiveServer and click Restart in the Actions column.

      2. In the dialog box that appears, enter an Execution Reason and click OK.

      3. In the Confirm dialog box, click OK.