Преглед изворни кода

HUE-8888 [docs] More info about Solr and Sentry

Romain пре 6 година
родитељ
комит
2b70b31c72

+ 90 - 0
docs/docs-site/content/administrator/configuration/connectors/_index.md

@@ -1019,3 +1019,93 @@ under the `[[[default]]]` and `[[[ha]]]` sub-sections.
         proxy_api_url=http://yarn-proxy.com:8088/
         resourcemanager_port=8032
         history_server_api_url=http://yarn-rhs-com:19888/
+
+### Apache Sentry
+
+To have Hue point to a Sentry service and another host, modify these hue.ini properties:
+
+    [libsentry]
+      # Hostname or IP of server.
+      hostname=localhost
+
+      # Port the sentry service is running on.
+      port=8038
+
+      # Sentry configuration directory, where sentry-site.xml is located.
+      sentry_conf_dir=/etc/sentry/conf
+
+Hue will also automatically pick up the server name of HiveServer2 from the sentry-site.xml file of /etc/hive/conf.
+
+![Listing of Sentry Tables privileges](https://cdn.gethue.com/uploads/2019/04/HueSecurityRoles.png
+
+And that’s it, you can know specify who can see/do what directly in a Web UI! The app sits on top of the standard Sentry API and so it fully compatible with Sentry. Next planned features will bring Solr Collections, HBase privilege management as well as more bulk operations and a tighter integration with HDFS.
+
+
+To be able to edit roles and privileges in Hue, the logged-in Hue user needs to belong to a group in Hue that is also an admin group in Sentry (whatever UserGroupMapping Sentry is using, the corresponding groups must exist in Hue or need to be entered manually). For example, our ‘hive’ user belongs to a ‘hive’ group in Hue and also to a ‘hive’ group in Sentry:
+
+    <property>
+      <name>sentry.service.admin.group</name>
+      <value>hive,impala,hue</value>
+    </property>
+
+**Notes**
+
+* Create a role in the Sentry app through Hue
+* Grant privileges to that role such that the role can see the database in the Sentry app
+* Create a group in Hue with the same name as the role in Sentry
+* Grant that role to a user in Hue
+* Ensure that the user in Hue has an equivalent O/S level
+* Ensure a user has an O/S level account on all hosts and that user is part of a group with the same name as the group in Hue (this assumes that the default ShellBasedUnixGroupsMapping is set for HDFS in CM)
+
+Our users are:
+
+* hive (admin) belongs to the hive group
+* user1_1 belongs to the user_group1 group
+* user2_1 belongs to the user_group2 group
+
+We synced the Unix users/groups into Hue with these commands:
+
+    export HUE_CONF_DIR="/var/run/cloudera-scm-agent/process/`ls -alrt /var/run/cloudera-scm-agent/process | grep HUE | tail -1 | awk '{print $9}'`"
+
+    build/env/bin/hue useradmin_sync_with_unix --min-uid=1000
+
+If using the package version and has the CDH repository register, install sentry with:
+
+    sudo apt-get install sentry
+
+If using Kerberos, make sure ‘hue’ is allowed to connect to Sentry in /etc/sentry/conf/sentry-site.xml:
+
+    <property>
+        <name>sentry.service.allow.connect</name>
+        <value>impala,hive,solr,hue</value>
+    </property>
+
+Here is an example of sentry-site.xml
+
+    <?xml version="1.0" encoding="UTF-8"?>
+    <configuration>
+    <property>
+      <name>sentry.service.security.mode</name>
+      <value>none</value>
+    </property>
+    <property>
+      <name>sentry.service.admin.group</name>
+      <value>hive,romain</value>
+    </property>
+    <property>
+      <name>sentry.service.allow.connect</name>
+      <value>impala,hive,solr</value>
+    </property>
+    <property>
+      <name>sentry.store.jdbc.url</name>
+      <value>jdbc:derby:;databaseName=sentry_store_db;create=true</value>
+    </property>
+    <property>
+      <name>sentry.store.jdbc.driver</name>
+      <value>org.apache.derby.jdbc.EmbeddedDriver</value>
+    </property>
+    <property>
+      <name>sentry.store.jdbc.password</name>
+      <value>aaa</value>
+    </property>
+    </configuration>

+ 125 - 28
docs/docs-site/content/user/browsing/_index.md

@@ -287,34 +287,6 @@ will suggest next steps to complete your query.
 
 Solr indexes can be created and are listed in the interface.
 
-## Sentry Permissions
-
-Sentry roles and privileges can directly be edited in the Security interface.
-
-**Note** Sentry is going to be replaced by Apache Ranger in [HUE-8748](https://issues.cloudera.org/browse/HUE-8748).
-
-### SQL
-
-[Hive UI](http://gethue.com/apache-sentry-made-easy-with-the-new-hue-security-app/).
-
-### Solr
-
-[Solr](http://gethue.com/ui-to-edit-sentry-privilege-of-solr-collections/) privileges can be edited directly via the interface.
-
-For listing collections, query and creating collection:
-
-    Admin=*->action=*
-    Collection=*->action=*
-    Schema=*->action=*
-    Config=*->action=*
-
-### Kafka
-
-Kafka topics can be listed.
-
-**Note** This is currently an experimental feature.
-
-
 ## Jobs
 
 The Job Browser application lets you to examine multiple types of jobs
@@ -352,3 +324,128 @@ List submitted workflows, schedules and bundles.
 ### Livy / Spark
 
 List Livy sessions and submitted statements.
+
+## Streams
+
+### Kafka
+
+Topics, Streams, tables can be listed via the `ksql` connector.
+
+## Sentry Permissions
+
+Sentry roles and privileges can directly be edited in the Security interface.
+
+**Note** Apache Sentry is going to be replaced by Apache Ranger in [HUE-8748](https://issues.cloudera.org/browse/HUE-8748).
+
+### SQL
+
+It can be tricky to grant a new user proper permissions on a secure cluster, let’s walk through the steps to enable any new user for table creation on a kerberized cluster. Depends on your cluster size, creating user and group on each node can be tedious. Here we use pssh (Parallel ssh) for this task.
+
+1. Install the tool and prepare a file which contains all your hosts.
+
+For Mac user:
+
+    brew install pssh
+
+For Debian or Ubuntu user:
+
+    sudo apt-get install pssh
+
+    cat ~/Documents/nodeshue.txt
+    hue-1.test.cloudera.com
+    hue-2.test.cloudera.com
+    hue-3.test.cloudera.com
+    hue-4.test.cloudera.com
+
+2. Run follow commands to create user: t1 and group: grp1 on your cluster:
+
+    pssh -h ~/Documents/nodeshue.txt -i useradd t1
+    [1] 13:58:48 [SUCCESS] hue-1.test.cloudera.com
+    [2] 13:58:48 [SUCCESS] hue-2.test.cloudera.com
+    [3] 13:58:48 [SUCCESS] hue-3.test.cloudera.com
+    [4] 13:58:48 [SUCCESS] hue-4.test.cloudera.com
+
+    pssh --hosts ~/Documents/nodes.txt -i groupadd grp1
+    [1] 13:59:20 [SUCCESS] hue-1.test.cloudera.com
+    [2] 13:59:20 [SUCCESS] hue-2.test.cloudera.com
+    [3] 13:59:20 [SUCCESS] hue-3.test.cloudera.com
+    [4] 13:59:20 [SUCCESS] hue-4.test.cloudera.com
+
+    pssh --hosts ~/Documents/nodes.txt -i usermod -a -G grp1 t1
+    [1] 13:59:28 [SUCCESS] hue-1.test.cloudera.com
+    [2] 13:59:28 [SUCCESS] hue-2.test.cloudera.com
+    [3] 13:59:28 [SUCCESS] hue-3.test.cloudera.com
+    [4] 13:59:28 [SUCCESS] hue-4.test.cloudera.com
+
+3. Create same Hue user: t1 and group: grp1 and make “t1″a member of “grp1”.
+
+4. Then log in as any user with sentry admin permission to run following queries in hive editor:
+
+    create role write_role;
+    GRANT ROLE write_role TO GROUP grp1;
+    GRANT ALL ON SERVER server1 TO ROLE write_role;
+
+Now “t1” user or any user in “grp1” can log in and create table by running any hive/impala DDL queries or through Hue importer.
+
+
+But mostly we would like to grant proper permissions for users instead of “ALL” on “server”. let’s walk through two other examples like read_only_role and read_write_role for specific databases.
+
+Using similar commands to create t2 user in group grp2 and t3 user in group grp3 on cluster and Hue. Then use following statements to grant proper permission to each group:
+
+1. Read write access to database: ‘s3db’ for any user in group ‘grp3’:
+
+    create role read_write_s3db_role;
+    GRANT ROLE read_write_s3db_role TO GROUP grp3;
+    GRANT ALL ON DATABASE s3db TO ROLE read_write_s3db_role;
+    GRANT ALL ON URI 'hdfs://hue-1.test.cloudera.com:8020/user/t3' to ROLE read_write_s3db_role;
+
+2. Read only permission for database: ‘default’ for any user in group ‘grp2’:
+
+    create role read_only_defaultDb_role;
+    GRANT ROLE read_only_defaultDb_role TO GROUP grp2;
+    GRANT SELECT ON DATABASE default TO ROLE read_only_defaultDb_role;
+    GRANT REFRESH ON DATABASE default TO ROLE read_only_defaultDb_role;
+
+Now ‘t3’ user can read and create new tables in database:s3db while ‘t2’ user can read database: default only.
+
+We can grant those permission through Hue security page too, it should ends like following.
+
+![Listing of Sentry Table privileges](https://cdn.gethue.com/uploads/2019/04/HueSecurityRoles.png)
+
+Note: You have to grant URI permission to avoid following error during table creation:
+
+    Error while compiling statement: FAILED: SemanticException No valid privileges User t3 does not have privileges for CREATETABLE The required privileges: Server=server1->URI=hdfs://hue-1.gce.cloudera.com:8020/user/t3/t3_dir->action=*->grantOption=false;
+
+
+### Solr
+
+[Solr](http://gethue.com/ui-to-edit-sentry-privilege-of-solr-collections/) privileges can be edited directly via the interface.
+
+For listing collections, query and creating collection:
+
+    Admin=*->action=*
+    Collection=*->action=*
+    Schema=*->action=*
+    Config=*->action=*
+
+
+![Listing of Solr collection](https://cdn.gethue.com/uploads/2016/05/solr-secu-1024x624.png)
+Listing of Solr collections and configs with their related privileges.
+
+![Listing of all the roles and their privileges.](https://cdn.gethue.com/uploads/2016/05/solr-secu2-e1464909489928.png)
+Listing of all the roles and their privileges. Possibility to filter by groups.
+
+
+![Apply privilege to all the collections or configs with *](https://cdn.gethue.com/uploads/2016/05/solr-sentry-query-error.png)
+Apply privilege to all the collections or configs with *
+
+
+![End user error when querying a collection without the QUERY privilege](https://cdn.gethue.com/uploads/2016/06/solr-sentry-all.png)
+End user error when querying a collection without the QUERY privilege
+
+
+![End user error when modifying a record without the UPDATE privilege](https://cdn.gethue.com/uploads/2016/06/solr-sentry-update-error.png)
+End user error when modifying a record without the UPDATE privilege
+
+
+### HDFS Acls

+ 55 - 1
docs/docs-site/content/user/querying/_index.md

@@ -217,7 +217,7 @@ Also read about building some [better autocompletes](/developer/parsers/) or ext
 
 Dashboards are an interactive way to explore your data quickly and easily. No programming is required and the analysis is done by drag & drops and clicks.
 
-Read more about [Dashboards](http://gethue.com/search-dashboards/).
+![Search Full](https://cdn.gethue.com/uploads/2015/08/search-full-mode.png)
 
 Simply drag & drop widgets that are interconnected together. This is great for exploring new datasets or monitoring without having to type.
 
@@ -225,6 +225,60 @@ The top search bar offers a [full autocomplete](http://gethue.com/intuitively-di
 
 The “More like This” feature lets you selected fields you would like to use to find similar records. This is a great way to find similar issues, customers, people... with regard to a list of attributes.
 
+### Marker Map
+Points close to each other are grouped together and will expand when zooming-in. A Yelp-like search filtering experience can also be created by checking the box.
+
+![Marker Map](https://cdn.gethue.com/uploads/2015/08/search-marker-map.png)
+
+### Edit records
+
+Indexed records can be directly edited in the Grid or HTML widgets by admins.
+
+### link to original documents
+
+Links to the original documents can also be inserted. Add to the record a field named ‘link-meta’ that contains some json describing the URL or address of a table or file that can be open in the HBase Browser, Metastore App or File Browser:
+
+Any link
+
+    {'type': 'link', 'link': 'gethue.com'}
+
+HBase Browser
+
+    {'type': 'hbase', 'table': 'document_demo', 'row_key': '20150527'}
+    {'type': 'hbase', 'table': 'document_demo', 'row_key': '20150527', 'fam': 'f1'}
+    {'type': 'hbase', 'table': 'document_demo', 'row_key': '20150527', 'fam': 'f1', 'col': 'c1'}
+
+File Browser
+
+    {'type': 'hdfs', 'path': '/data/hue/file.txt'}
+
+Table Catalog
+
+    {'type': 'hive', 'database': 'default', 'table': 'sample_07'}
+
+![Data Links](https://cdn.gethue.com/uploads/2015/08/search-link-1024x630.png)
+
+### Save queries
+
+Current selected facets and filters, query strings can be saved with a name within the dashboard. These are useful for defining “cohorts” or pre-selection of records and quickly reloading them.
+
+![Rolling time](https://cdn.gethue.com/uploads/2015/08/search-query-def-1024x507.png)
+
+### ‘Fixed’ or ‘rolling’ time window
+
+Real time indexing can now shine with the rolling window filter and the automatic refresh of the dashboard every N seconds. See it in action in the real time Twitter indexing with Spark streaming post.
+
+![Rolling time](https://cdn.gethue.com/uploads/2015/08/search-fixed-time.png)
+
+### Nested Analytics facets
+
+![Nested Analytics facets](https://cdn.gethue.com/uploads/2015/08/search-nested-facet-1024x304.png)
+![Nested Analytics Counts](https://cdn.gethue.com/uploads/2015/08/search-hit-widget.png)
+
+A more comprehensive demo is available on the [BikeShare data visualization post](http://gethue.com/bay-area-bikeshare-data-analysis-with-search-and-spark-notebook/).
+
+
+
 ## Jobs
 
 In addition to SQL queries, the Editor application enables you to create and submit batch jobs to the cluster.