[
https://issues.apache.org/jira/browse/RANGER-5668?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bhavesh Amre resolved RANGER-5668.
----------------------------------
Fix Version/s: 3.0.0
Resolution: Fixed
> INSERT INTO External Hive Table Fails for Table/Database Owner When Access Is
> Granted Through Ranger {OWNER} Policy
> -------------------------------------------------------------------------------------------------------------------
>
> Key: RANGER-5668
> URL: https://issues.apache.org/jira/browse/RANGER-5668
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Affects Versions: 3.0.0
> Reporter: Sanket Shelar
> Assignee: Bhavesh Amre
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> INSERT INTO External Hive Table Fails for Table/Database Owner When Access Is
> Granted Through Ranger \{OWNER} Policy.
>
> User hrt_alpha101 creates both the Hive database and the external table and
> is recorded as the owner in Hive Metastore. A Ranger Hive policy grants all
> permissions to {OWNER}. Despite this, INSERT INTO operations on newly created
> external tables fail with:
> HiveAccessControlException: Permission denied: user [hrt_alpha101] does not
> have [UPDATE] privilege
> The issue appears to be related to owner-based authorization evaluation.
> After forcing a Ranger policy refresh (by modifying and saving the policy),
> the same INSERT operation succeeds without any other changes.
> The behavior is reproducible on newly created external tables, where
> ownership is correctly set but Ranger does not initially honor the {OWNER}
> policy.
> Steps To Repro:
> # ssh into node, generate a kerberos ticket and open beeline and Execute
> below Queries:
>
> {code:java}
> CREATE DATABASE IF NOT EXISTS interop_pvc_db3;
> USE interop_pvc_db3;
> -- 1. Create External Partitioned Table
> -- Note: Replace the LOCATION path with your shared HDFS/S3/ADLS test
> directory
> CREATE EXTERNAL TABLE order_logs (
> order_id INT,
> product_name STRING,
> amount DOUBLE
> )
> PARTITIONED BY (region STRING)
> STORED AS PARQUET
> LOCATION
> 'hdfs://ns1/tmp/hybrid_hive_interop/tavhz1/tmp/interop_pvc_db3/order_logs';
> -- 2. Insert initial baseline partitions
> INSERT INTO TABLE order_logs PARTITION(region='APAC') VALUES (1, 'Laptop',
> 1200.00);
> {code}
>
>
> # In cm_hdfs ranger, give permission to location:
> hdfs://ns1/tmp/hybrid_hive_interop to hrt_alpha101 user.
> {code:java}
> describe database interop_pvc_db3;{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
