--- title: Apache Sentry made easy with the new Hue Security App author: admin type: post date: 2014-10-07T20:24:42+00:00 url: /apache-sentry-made-easy-with-the-new-hue-security-app/ sf_thumbnail_type: - none sf_thumbnail_link_type: - link_to_post sf_detail_type: - none sf_page_title: - 1 sf_page_title_style: - standard sf_no_breadcrumbs: - 1 sf_page_title_bg: - none sf_page_title_text_style: - light sf_background_image_size: - cover sf_social_sharing: - 1 sf_sidebar_config: - left-sidebar sf_left_sidebar: - Sidebar-2 sf_right_sidebar: - Sidebar-1 sf_caption_position: - caption-right sf_remove_promo_bar: - 1 slide_template: - default categories: --- Hi Hadoop Sheriffs, In order to support the growth of the [Apache Sentry][1] project and make it easier to secure your cluster, a new app was added into Hue. Sentry privileges determine which [Hive / Impala][2] databases and tables a user can see or modify. The Security App let’s you create/edit/delete Roles and Privileges directly from your browser (there is no sentry-provider.ini file to edit anymore). Here is a video showing how the app works: {{< youtube ZwZWA_nBGDs >}} Main features: - Bulk edit roles and privileges - Visualize/edit roles and privileges on a database tree - WITH GRANT OPTION support - Impersonate a user to see which databases and table he can see [][3] To have Hue point to a Sentry service and another host, modify these [hue.ini][4] properties:
[libsentry]

 # Hostname or IP of server.

 hostname=localhost

 # Port the sentry service is running on.

 port=8038

 # Sentry configuration directory, where sentry-site.xml is located.

 sentry_conf_dir=/etc/sentry/conf

Hue will also automatically pick up the server name of HiveServer2 from the sentry-site.xml file of /etc/hive/conf.   And that’s it, you can know specify who can see/do what directly in a Web UI! The app sits on top of the standard Sentry API and so it fully compatible with Sentry. Next planned features will bring [Solr Collections][5], [HBase][6] privilege management as well as more bulk operations and a tighter integration with HDFS. As usual, feel free to continue to send us questions and feedback on the [hue-user][7] list or [@gethue][8]! Notes To be able to edit roles and privileges in Hue, the logged-in Hue user needs to belong to a **group in Hue** that is also an **admin group in Sentry** (whatever UserGroupMapping Sentry is using, the corresponding groups must exist in Hue or need to be entered manually). For example, our 'hive' user belongs to a 'hive' group in Hue and also to a 'hive' group in Sentry:


  sentry.service.admin.group

  hive,impala,hue



  **Notes** - Create a role in the Sentry app through Hue - Grant privileges to that role such that the role can see the database in the Sentry app - Create a group in Hue with the same name as the role in Sentry - Grant that role to a user in Hue - Ensure that the user in Hue has an equivalent O/S level - Ensure a user has an O/S level account on all hosts and that user is part of a group with the same name as the group in Hue (this assumes that the default ShellBasedUnixGroupsMapping is set for HDFS in CM)   **Notes** We are using CDH5.2+ with Kerberos MIT and Sentry configured. The app also works in non secure mode. Our users are: - hive (admin) belongs to the hive group - user1_1 belongs to the user_group1 group - user2_1 belongs to the user_group2 group We [synced the Unix users/groups][9] into Hue with these commands:
export HUE_CONF_DIR="/var/run/cloudera-scm-agent/process/\`ls -alrt /var/run/cloudera-scm-agent/process | grep HUE | tail -1 | awk '{print $9}'\`"

build/env/bin/hue useradmin_sync_with_unix -min-uid=1000

If using the package version and has the CDH repository register, install sentry with:
sudo apt-get install sentry

If using Kerberos, make sure ‘hue’ is allowed to connect to Sentry in /etc/sentry/conf/sentry-site.xml:


  sentry.service.allow.connect

  impala,hive,solr,hue



Here is an example of sentry-site.xml Here is an example of sentry-site.xml






sentry.service.security.mode

none





sentry.service.admin.group

hive,romain





sentry.service.allow.connect

impala,hive,solr





sentry.store.jdbc.url

jdbc:derby:;databaseName=sentry_store_db;create=true





sentry.store.jdbc.driver

org.apache.derby.jdbc.EmbeddedDriver





sentry.store.jdbc.password

aaa





For testing purposes, here is how to create the initial Sentry database:
romain@runreal:~/projects/hue$ sentry -command schema-tool -initSchema -conffile /etc/sentry/conf/sentry-site.xml -dbType derby

And start the service:
sentry -command service  -conffile /etc/sentry/conf/sentry-site.xml

**Note** In Sentry 1.5, you will need to specify a ‘entry.store.jdbc.password’ property in the sentry-site.xml, if not you will get:
Caused by: org.apache.sentry.provider.db.service.thrift.SentryConfigurationException: Error reading sentry.store.jdbc.password

[1]: http://sentry.incubator.apache.org/ [2]: https://gethue.com/hadoop-tutorial-new-impala-and-hive-editors/ [3]: https://cdn.gethue.com/uploads/2014/10/hue-sentry.png [4]: https://gethue.com/how-to-configure-hue-in-your-hadoop-cluster/ [5]: https://gethue.com/hadoop-search-dynamic-search-dashboards-with-solr [6]: https://gethue.com/the-web-ui-for-hbase-hbase-browser/ [7]: http://groups.google.com/a/cloudera.org/group/hue-user [8]: https://twitter.com/gethue [9]: https://gethue.com/hadoop-tutorial-how-to-integrate-unix-users-and-groups/