6/07/2021

Ranger - Hive policy activation time delayed by more than ...

Just a quick blog here about an issue I had with HDP-3.1.4.0.  I recently was setting up a new user with specific rights in Ranger for Hive access.  After creating the new policy and attempting to validate it, I received an error message stating that the hive user does not have use privilege.  This error was produced even though I had just created the policy specifically granting those privilege's.

Upon further review I noticed that the plugin was downloading the policy, but not applying it.  You would find this information here in Ranger:


After much searching around, I could not find a specific article detailing this issue and the resolution.

What I did find was this article:

https://issues.apache.org/jira/browse/RANGER-2348

Although I am not running interactive mode, comments in the link above did point me to what the ultimate issue was; "multiple versions of jersey libs inside the classpath."

What I found was that the ../hive/lib/* directories contained both of these:
jersey-client-1.19.jar
jersey-client-2.25.1.jar

The final resolution was to remove jersey-client-1.19.jar, which resolved the classpath conflict and allowed the Ranger policies to be applied without failing.

This seems to be a generic issue with Ranger/Hive in HDP 3.1.4, perhaps other versions as well.

I hope this helps someone googling around for:
hive user does not have use privilege
or, ranger hive "policy activation time delayed by more than"