E-MapReduce:DLF-Auth

Supported EMR versions and compute engines

Step 1: Enable Hive in DLF-Auth

1. In the EMR console, click EMR on ECS in the left-side navigation pane.

2. Select your region and resource group, then find your cluster and click Services in the Actions column.

3. On the Services tab, find DLF-Auth and click Status.

4. In the Service Overview section, turn on enableHive and click OK in the confirmation message.

5. Restart HiveServer:

   1. On the Services tab, find Hive and click Status.

   2. In the Components section, find HiveServer and click Restart in the Actions column.

   3. Enter an execution reason and click OK, then click OK again in the confirmation dialog.

Step 2: Add a RAM user

DLF allows only RAM users to manage permissions. Use the user management feature to add a RAM user to your cluster.

1. In the EMR console, navigate to your cluster and click Services in the Actions column.

2. Click the Users tab, then click Add User.

3. In the Add User dialog box, select a RAM user from the Username drop-down list and set Password and Confirm Password.

4. Click OK.

Step 3: Verify and grant permissions

Verify current permissions

1. Log on to your cluster via SSH. For more information, see Log on to a cluster.

2. Connect to HiveServer2:

   beeline -u jdbc:hive2://master-1-1:10000 -n <user> -p <password>

   Replace <user> and <password> with the credentials you set in Step 2.

3. Query an existing table:

   select * from testdb.test;

   Replace testdb.test with your actual table name. If the RAM user lacks permissions, an error is returned.

   

Grant permissions in the DLF console

1. Log on to the DLF console.

2. In the left-side navigation pane, choose Data Permission > Data Permissions.

3. Click Add Permission and configure the parameters:

   Parameter	Description	Example
   Principal Type	The type of identity to grant permissions to.	RAM User/Role (default)
   Choose Principal	The RAM user to grant permissions to.	Select the user added in Step 2
   Authorization Method	How the permission is scoped.	Resource Authorization (default)
   Resource Type	The type of resource to control access to.	Metadata table
   Data Permission	The operation the user is permitted to perform.	Select
   Granted Permission	The permission that is granted to the principal.	—

4. Click OK.

Verify that permissions take effect

1. Run the table query again from step 3. The query succeeds, confirming the Select permission is in effect.

Step 4 (Optional): Enable LDAP authentication for Hive

After enabling DLF-Auth, enable Lightweight Directory Access Protocol (LDAP) authentication for Hive so that all users connecting to Hive must authenticate before running queries.

1. In the EMR console, navigate to your cluster and click Services in the Actions column.

2. On the Services tab, click Status in the Hive section.

3. Enable enableLDAP based on your EMR version:

   • EMR V5.11.1 and later minor versions, or EMR V3.45.1 and later minor versions: In the Service Overview section, turn on enableLDAP and click OK.

   • EMR V5.11.0 and earlier minor versions, or EMR V3.45.0 and earlier minor versions: In the Components section, find HiveServer, click > enableLDAP, enter an execution reason, and click OK in both dialogs.

4. Restart HiveServer:

   1. In the Components section, find HiveServer and click Restart in the Actions column.

   2. Enter an execution reason and click OK, then click OK again in the confirmation dialog.