Sanket Shelar created RANGER-5668:
-------------------------------------
Summary: INSERT INTO External Hive Table Fails for Table/Database
Owner When Access Is Granted Through Ranger {OWNER} Policy
Key: RANGER-5668
URL: https://issues.apache.org/jira/browse/RANGER-5668
Project: Ranger
Issue Type: Bug
Components: Ranger
Affects Versions: 3.0.0
Reporter: Sanket Shelar
Assignee: Bhavesh Amre
INSERT INTO External Hive Table Fails for Table/Database Owner When Access Is
Granted Through Ranger \{OWNER} Policy.
User hrt_alpha101 creates both the Hive database and the external table and is
recorded as the owner in Hive Metastore. A Ranger Hive policy grants all
permissions to {OWNER}. Despite this, INSERT INTO operations on newly created
external tables fail with:
HiveAccessControlException: Permission denied: user [hrt_alpha101] does not
have [UPDATE] privilege
The issue appears to be related to owner-based authorization evaluation. After
forcing a Ranger policy refresh (by modifying and saving the policy), the same
INSERT operation succeeds without any other changes.
The behavior is reproducible on newly created external tables, where ownership
is correctly set but Ranger does not initially honor the {OWNER} policy.
Steps To Repro:
# ssh into node, generate a kerberos ticket and open beeline and Execute below
Queries:
{code:java}
CREATE DATABASE IF NOT EXISTS interop_pvc_db3;
USE interop_pvc_db3;
-- 1. Create External Partitioned Table
-- Note: Replace the LOCATION path with your shared HDFS/S3/ADLS test directory
CREATE EXTERNAL TABLE order_logs (
order_id INT,
product_name STRING,
amount DOUBLE
)
PARTITIONED BY (region STRING)
STORED AS PARQUET
LOCATION
'hdfs://ns1/tmp/hybrid_hive_interop/tavhz1/tmp/interop_pvc_db3/order_logs';
-- 2. Insert initial baseline partitions
INSERT INTO TABLE order_logs PARTITION(region='APAC') VALUES (1, 'Laptop',
1200.00);
{code}
# In cm_hdfs ranger, give permission to location:
hdfs://ns1/tmp/hybrid_hive_interop to hrt_alpha101 user.
{code:java}
describe database interop_pvc_db3;{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
