Just a quick blog here about an issue I had with HDP-3.1.4.0. I recently was setting up a new user with specific rights in Ranger for Hive access. After creating the new policy and attempting to validate it, I received an error message stating that the hive user does not have use privilege. This error was produced even though I had just created the policy specifically granting those privilege's.
Upon further review I noticed that the plugin was downloading the policy, but not applying it. You would find this information here in Ranger:
After much searching around, I could not find a specific article detailing this issue and the resolution.
What I did find was this article:
https://issues.apache.org/jira/browse/RANGER-2348
Although I am not running interactive mode, comments in the link above did point me to what the ultimate issue was; "multiple versions of jersey libs inside the classpath."
What I found was that the ../hive/lib/* directories contained both of these:
jersey-client-1.19.jar
jersey-client-2.25.1.jar
The final resolution was to remove jersey-client-1.19.jar, which resolved the classpath conflict and allowed the Ranger policies to be applied without failing.
This seems to be a generic issue with Ranger/Hive in HDP 3.1.4, perhaps other versions as well.
I hope this helps someone googling around for:
hive user does not have use privilege
or, ranger hive "policy activation time delayed by more than"
No comments:
Post a Comment