---
title: Apache Sentry made easy with the new Hue Security App
author: admin
type: post
date: 2014-10-07T20:24:42+00:00
url: /apache-sentry-made-easy-with-the-new-hue-security-app/
sf_thumbnail_type:
- none
sf_thumbnail_link_type:
- link_to_post
sf_detail_type:
- none
sf_page_title:
- 1
sf_page_title_style:
- standard
sf_no_breadcrumbs:
- 1
sf_page_title_bg:
- none
sf_page_title_text_style:
- light
sf_background_image_size:
- cover
sf_social_sharing:
- 1
sf_sidebar_config:
- left-sidebar
sf_left_sidebar:
- Sidebar-2
sf_right_sidebar:
- Sidebar-1
sf_caption_position:
- caption-right
sf_remove_promo_bar:
- 1
slide_template:
- default
categories:
---
Hi Hadoop Sheriffs,
In order to support the growth of the [Apache Sentry][1] project and make it easier to secure your cluster, a new app was added into Hue. Sentry privileges determine which [Hive / Impala][2] databases and tables a user can see or modify. The Security App let’s you create/edit/delete Roles and Privileges directly from your browser (there is no sentry-provider.ini file to edit anymore).
Here is a video showing how the app works:
{{< youtube ZwZWA_nBGDs >}}
Main features:
- Bulk edit roles and privileges
- Visualize/edit roles and privileges on a database tree
- WITH GRANT OPTION support
- Impersonate a user to see which databases and table he can see
[
][3]
To have Hue point to a Sentry service and another host, modify these [hue.ini][4] properties:
[libsentry]
# Hostname or IP of server.
hostname=localhost
# Port the sentry service is running on.
port=8038
# Sentry configuration directory, where sentry-site.xml is located.
sentry_conf_dir=/etc/sentry/conf
Hue will also automatically pick up the server name of HiveServer2 from the sentry-site.xml file of /etc/hive/conf.
And that’s it, you can know specify who can see/do what directly in a Web UI! The app sits on top of the standard Sentry API and so it fully compatible with Sentry. Next planned features will bring [Solr Collections][5], [HBase][6] privilege management as well as more bulk operations and a tighter integration with HDFS.
As usual, feel free to continue to send us questions and feedback on the [hue-user][7] list or [@gethue][8]!
Notes
To be able to edit roles and privileges in Hue, the logged-in Hue user needs to belong to a **group in Hue** that is also an **admin group in Sentry** (whatever UserGroupMapping Sentry is using, the corresponding groups must exist in Hue or need to be entered manually). For example, our 'hive' user belongs to a 'hive' group in Hue and also to a 'hive' group in Sentry:
sentry.service.admin.group
hive,impala,hue
**Notes**
- Create a role in the Sentry app through Hue
- Grant privileges to that role such that the role can see the database in the Sentry app
- Create a group in Hue with the same name as the role in Sentry
- Grant that role to a user in Hue
- Ensure that the user in Hue has an equivalent O/S level
- Ensure a user has an O/S level account on all hosts and that user is part of a group with the same name as the group in Hue (this assumes that the default ShellBasedUnixGroupsMapping is set for HDFS in CM)
**Notes**
We are using CDH5.2+ with Kerberos MIT and Sentry configured. The app also works in non secure mode.
Our users are:
- hive (admin) belongs to the hive group
- user1_1 belongs to the user_group1 group
- user2_1 belongs to the user_group2 group
We [synced the Unix users/groups][9] into Hue with these commands:
export HUE_CONF_DIR="/var/run/cloudera-scm-agent/process/\`ls -alrt /var/run/cloudera-scm-agent/process | grep HUE | tail -1 | awk '{print $9}'\`"
build/env/bin/hue useradmin_sync_with_unix -min-uid=1000
If using the package version and has the CDH repository register, install sentry with:
sudo apt-get install sentry
If using Kerberos, make sure ‘hue’ is allowed to connect to Sentry in /etc/sentry/conf/sentry-site.xml:
sentry.service.allow.connect
impala,hive,solr,hue
Here is an example of sentry-site.xml
Here is an example of sentry-site.xml
sentry.service.security.mode
none
sentry.service.admin.group
hive,romain
sentry.service.allow.connect
impala,hive,solr
sentry.store.jdbc.url
jdbc:derby:;databaseName=sentry_store_db;create=true
sentry.store.jdbc.driver
org.apache.derby.jdbc.EmbeddedDriver
sentry.store.jdbc.password
aaa
For testing purposes, here is how to create the initial Sentry database:
romain@runreal:~/projects/hue$ sentry -command schema-tool -initSchema -conffile /etc/sentry/conf/sentry-site.xml -dbType derby
And start the service:
sentry -command service -conffile /etc/sentry/conf/sentry-site.xml
**Note**
In Sentry 1.5, you will need to specify a ‘entry.store.jdbc.password’ property in the sentry-site.xml, if not you will get:
Caused by: org.apache.sentry.provider.db.service.thrift.SentryConfigurationException: Error reading sentry.store.jdbc.password
[1]: http://sentry.incubator.apache.org/
[2]: https://gethue.com/hadoop-tutorial-new-impala-and-hive-editors/
[3]: https://cdn.gethue.com/uploads/2014/10/hue-sentry.png
[4]: https://gethue.com/how-to-configure-hue-in-your-hadoop-cluster/
[5]: https://gethue.com/hadoop-search-dynamic-search-dashboards-with-solr
[6]: https://gethue.com/the-web-ui-for-hbase-hbase-browser/
[7]: http://groups.google.com/a/cloudera.org/group/hue-user
[8]: https://twitter.com/gethue
[9]: https://gethue.com/hadoop-tutorial-how-to-integrate-unix-users-and-groups/