[
https://issues.apache.org/jira/browse/SENTRY-3?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13755139#comment-13755139
]
Prasad Mujumdar commented on SENTRY-3:
--------------------------------------
Sentry tool examples -
- Tool Usage message
{noformat}
$ bin/senty.sh --hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
--hive-config /home/prasadm/repos/CDH/hive-CDH4 -h
Using hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
Using hive-conf-dir /home/prasadm/repos/CDH/hive-CDH4
usage: Sentry
-d,--listPerms enable debug output
-e,--query <arg> Query privilege verification, requires -u
-h,--help Print usage
-l,--listPerms list permissions for given user, requires -u
-p,--policy <arg> Policy file path
-s,--sentry-site <arg> sentry-site file path
-u,--user <arg> user name
-v,--validate Validate policy file
{noformat}
- Verify policy file
{noformat}
$ bin/senty.sh --hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
--hive-config /home/prasadm/repos/CDH/hive-CDH4 -v
Using hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
Using hive-conf-dir /home/prasadm/repos/CDH/hive-CDH4
Configuration:
Using Sentry package from jar
file:/home/prasadm/repos/cloudera-org/sentry/sentry-dist/target/sentry-1.2.0-SNAPSHOT/lib/sentry-binding-hive-1.2.0-SNAPSHOT.jar
Using hive config file /home/prasadm/repos/CDH/hive-CDH4/hive-site.xml
Using Sentry config file file:/home/prasadm/sentry/config/sentry-site.xml
Using Policy file file:///home/prasadm/sentry/config/global-policy.ini
Sentry server name set to server1
No errors found in the policy file
{noformat}
- Verify invalid policy file
{noformat}
]$ bin/senty.sh --hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
--hive-config /home/prasadm/repos/CDH/hive-CDH4 -v -p
file:///home/prasadm/sentry/config/global-policy-bad.ini
Using hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
Using hive-conf-dir /home/prasadm/repos/CDH/hive-CDH4
Configuration:
Using Sentry package from jar
file:/home/prasadm/repos/cloudera-org/sentry/sentry-dist/target/sentry-1.2.0-SNAPSHOT/lib/sentry-binding-hive-1.2.0-SNAPSHOT.jar
Using hive config file /home/prasadm/repos/CDH/hive-CDH4/hive-site.xml
Using Sentry config file file:/home/prasadm/sentry/config/sentry-site.xml
Using Policy file file:///home/prasadm/sentry/config/global-policy-bad.ini
Sentry server name set to server1
*** Found configuration problems ***
ERROR: Failed to process global policy file
file:/home/prasadm/sentry/config/global-policy-bad.ini
Warning: Role non-existant-role for group admin does not exist in privileges
section in file:/home/prasadm/sentry/config/global-policy-bad.ini
Warning: Role non-existant-role for group admin does not exist in privileges
section in file:/home/prasadm/sentry/config/global-policy-bad.ini
Sentry tool reported Errors:
{noformat}
- List privileges for a user
{noformat}
$ bin/senty.sh --hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
--hive-config /home/prasadm/repos/CDH/hive-CDH4 -l -u prasadm -p
file:///home/prasadm/sentry/config/global-policy.ini
Using hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
Using hive-conf-dir /home/prasadm/repos/CDH/hive-CDH4
Configuration:
Using Sentry package from jar
file:/home/prasadm/repos/cloudera-org/sentry/sentry-dist/target/sentry-1.2.0-SNAPSHOT/lib/sentry-binding-hive-1.2.0-SNAPSHOT.jar
Using hive config file /home/prasadm/repos/CDH/hive-CDH4/hive-site.xml
Using Sentry config file file:/home/prasadm/sentry/config/sentry-site.xml
Using Policy file file:///home/prasadm/sentry/config/global-policy.ini
Sentry server name set to server1
Available privileges for user prasadm:
server=server1->db=jranalyst1->table=*->action=select
server=server1->db=jranalyst1
server=server1->uri=hdfs://ha-nn-uri/landing/analyst1
server=server1->db=analyst1
server=server1->uri=hdfs://ha-nn-uri/landing/jranalyst1
server=server1->db=customers->table=*->action=select
server=server1->db=customers->table=*->action=insert
{noformat}
- Verify a query by user that has valid permission
{noformat}
$ bin/senty.sh --hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
--hive-config /home/prasadm/repos/CDH/hive-CDH4 -u hive -e "select * from tab2"
Using hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
Configuration:
Using Sentry package from jar
file:/home/prasadm/repos/cloudera-org/sentry/sentry-dist/target/sentry-1.2.0-SNAPSHOT/lib/sentry-binding-hive-1.2.0-SNAPSHOT.jar
Using hive config file /home/prasadm/repos/CDH/hive-CDH4/hive-site.xml
Using Sentry config file file:/home/prasadm/sentry/config/sentry-site.xml
Using Policy file file:///home/prasadm/sentry/config/global-policy.ini
Sentry server name set to server1
No errors found in the policy file
Hive history
file=/tmp/prasadm/hive_job_log_b56c6bba-dc64-41a9-8c6b-26798625e8dc_1442663083.txt
User hive has privileges to run the query
{noformat}
- Verify a query by user that doesn't valid permission
{noformat}
$ bin/senty.sh --hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
--hive-config /home/prasadm/repos/CDH/hive-CDH4/build/dist -u prasadm -e
"select * from tab2"
Using hive-home /home/prasadm/repos/CDH/hive-CDH4/build/dist
Configuration:
Using Sentry package from jar
file:/home/prasadm/repos/cloudera-org/sentry/sentry-dist/target/sentry-1.2.0-SNAPSHOT/lib/sentry-binding-hive-1.2.0-SNAPSHOT.jar
Using hive config file /home/prasadm/repos/CDH/hive-CDH4/hive-site.xml
Using Sentry config file file:/home/prasadm/sentry/config/sentry-site.xml
Using Policy file file:///home/prasadm/sentry/config/global-policy.ini
Sentry server name set to server1
No errors found in the policy file
Hive history
file=/tmp/prasadm/hive_job_log_c447609f-07f5-49db-b612-f6b9b3a750f8_949068149.txt
FAILED: SemanticException No valid privileges
*** Missing privileges for user prasadm:
Server=server1->Db=default->Table=tab2->action=select
User prasadm does NOT have privileges to run the query
Sentry tool reported Errors: Compilation error: FAILED: SemanticException No
valid privileges
{noformat}
> Create a diagnostics tool for configuration validation
> ------------------------------------------------------
>
> Key: SENTRY-3
> URL: https://issues.apache.org/jira/browse/SENTRY-3
> Project: Sentry
> Issue Type: New Feature
> Reporter: Prasad Mujumdar
> Assignee: Prasad Mujumdar
> Attachments: sentry-3-WIP-1.patch.patch
>
>
> Create a tool for offline troubleshooting -
> Validate the configuration
> List permissions for a given user
> Offline query validation
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
