:original_name: mrs_01_0949.html

.. _mrs_01_0949:

Creating a Hive Role
====================

Scenario
--------

This section describes how to create and configure a Hive role on Manager as the system administrator. The Hive role can be granted the permissions of the Hive administrator and the permissions to operate Hive table data.

Creating a database with Hive requires users to join in the **hive** group, without granting a role. Users have all permissions on the databases or tables created by themselves in Hive or HDFS. They can create tables, select, delete, insert, or update data, and grant permissions to other users to allow them to access the tables and corresponding HDFS directories and files. The created databases or tables are saved in the **/user/hive/warehouse** directory of the HDFS by default.

.. note::

   -  A Hive role can be created only in security mode.
   -  If the current component uses Ranger for permission control, you need to configure permission management policies based on Ranger. For details, see :ref:`Adding a Ranger Access Permission Policy for Hive <mrs_01_1858>`.

Prerequisites
-------------

-  The system administrator has understood the service requirements.
-  Log in to FusionInsight Manager.
-  The Hive client has been installed.

Procedure
---------

#. Log in to FusionInsight Manager. For details, see :ref:`Accessing FusionInsight Manager <mrs_01_2124>`.

#. Choose **System** > **Permission** > **Role**.

#. Click **Create Role**, and set **Role Name** and **Description**.

#. Set **Configure Resource Permission**. For details, see :ref:`Table 1 <mrs_01_0949__en-us_topic_0000001173630718_table715417215388>`.

   -  **Hive Admin Privilege**: Hive administrator permission.
   -  **Hive Read Write Privileges**: Hive data table management permission, which is the operation permission to set and manage the data of created tables.

   .. note::

      -  Hive role management supports the Hive administrator permissions and the permission of accessing databases, tables, and views.
      -  The permissions of the Hive administrator do not include the permission to manage HDFS.
      -  If there are too many tables in the database or too many files in tables, the permission granting may last a while. For example, if a table contains 10,000 files, the permission granting lasts about 2 minutes.

   .. _mrs_01_0949__en-us_topic_0000001173630718_table715417215388:

   .. table:: **Table 1** Setting a role

      +------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
      | Task                                                                                     | Role Authorization                                                                                                                                                                                                                                                                                                |
      +==========================================================================================+===================================================================================================================================================================================================================================================================================================================+
      | Setting the Hive administrator permission                                                | In the **Configure Resource Permission** table, choose *Name of the desired cluster* > **Hive** and select **Hive Admin Privilege**.                                                                                                                                                                              |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          | .. note::                                                                                                                                                                                                                                                                                                         |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |    After being bound to the Hive administrator role, perform the following operations during each maintenance operation:                                                                                                                                                                                          |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |    a. Log in to the node where the Hive client is installed as the client installation user.                                                                                                                                                                                                                      |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |    b. Run the following command to configure environment variables:                                                                                                                                                                                                                                               |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |       For example, if the Hive client installation directory is **/opt/hiveclient**, run **source /opt/hiveclient/bigdata_env**.                                                                                                                                                                                  |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |    c. Run the following command to authenticate the user:                                                                                                                                                                                                                                                         |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |       **kinit** *Hive service user*                                                                                                                                                                                                                                                                               |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |    d. Run the following command to log in to the client tool:                                                                                                                                                                                                                                                     |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |       **beeline**                                                                                                                                                                                                                                                                                                 |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |    e. Run the following command to update the Hive administrator permissions:                                                                                                                                                                                                                                     |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          |       **set role admin;**                                                                                                                                                                                                                                                                                         |
      +------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
      | Setting the permission to query a table of another user in the default database          | a. In the **Configure Resource Permission** table, choose *Name of the desired cluster* > **Hive** > **Hive Read Write Privileges**.                                                                                                                                                                              |
      |                                                                                          | b. Click the name of the specified database in the database list. Tables in the database are displayed.                                                                                                                                                                                                           |
      |                                                                                          | c. In the **Rights** column of the specified table, choose **Select**.                                                                                                                                                                                                                                            |
      +------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
      | Setting the permission to query a table of another user in the default database          | a. In the **Configure Resource Permission** table, choose *Name of the desired cluster* > **Hive** > **Hive Read Write Privileges**.                                                                                                                                                                              |
      |                                                                                          | b. Click the name of the specified database in the database list. Tables in the database are displayed.                                                                                                                                                                                                           |
      |                                                                                          | c. In the **Permission** column of the specified table, select **INSERT**.                                                                                                                                                                                                                                        |
      +------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
      | Setting the permission to import data to a table of another user in the default database | a. In the **Configure Resource Permission** table, choose *Name of the desired cluster* > **Hive** > **Hive Read Write Privileges**.                                                                                                                                                                              |
      |                                                                                          | b. Click the name of the specified database in the database list. Tables in the database are displayed.                                                                                                                                                                                                           |
      |                                                                                          | c. In the **Permission** column of the specified indexes, select **DELETE** and **INSERT**.                                                                                                                                                                                                                       |
      +------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
      | Setting the permission to submit HQL commands to Yarn for execution                      | The HQL commands used by some services are converted into MapReduce tasks and submitted to Yarn for execution. You need to set the Yarn permissions. For example, the HQL statements to be run use statements, such as **insert**, **count**, **distinct**, **group by**, **order by**, **sort by**, or **join**. |
      |                                                                                          |                                                                                                                                                                                                                                                                                                                   |
      |                                                                                          | a. In the **Permission** table, choose *Name of the desired cluster* > **Yarn** > **Scheduling Queue** > **root**.                                                                                                                                                                                                |
      |                                                                                          | b. In the **Permission** column of the **default** queue, select **Submit**.                                                                                                                                                                                                                                      |
      +------------------------------------------------------------------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

#. Click **OK**, and return to the **Role** page.
