免费观看又色又爽又黄的小说免费_美女福利视频国产片_亚洲欧美精品_美国一级大黄大色毛片

【總結】ApacheSentry服務簡介

    Sentry是一個RPC服務，將認證元數據信息存儲在關系型數據庫，并提供RPC接口檢索和操作權限。利用Kerveros支持安全訪問。Sentry Service通過后臺數據庫存儲提供認證元數據信息，不處理真實的權限驗證，當Hive,Impala等服務的配置使用Sentry權限的時候，Hive，Impala只作為Sentry的client。

我們提供的服務有：成都網站設計、網站建設、微信公眾號開發、網站優化、網站認證、徐匯ssl等。為成百上千家企事業單位解決了網站和推廣的問題。提供周到的售前咨詢和貼心的售后服務，是有科學管理、有技術的徐匯網站制作公司

    最早的Sentry是使用policy file配置權限，逐漸版本升級過程中，目前采用關系型數據庫存儲權限角色等。使用新的Sentry服務相比于舊的policy file能夠更容易處理用戶權限，新的Sentry服務提供了更傳統的 GRANT/REVOKE語句修改權限。

早版本Sentry中的策略文件policy file:

[groups] 
manager = customers_insert_role, 
customers_select_role
analyst = customers_select_role 
[roles] 
customers_insert_role = server=server1->db=customers->table=*->action=insert 
customers_select_role = server=server1->db=customers->table=*->action=select

Sentry歷史版本功能：

  • Sentry with policy files is added in CDH 5.1.0.

  • Sentry with config support is added in CDH 5.5.0.

  • Sentry with database-backed Sentry service is added with CDH 5.8.0.

Sentry中基礎名詞：

1.object Sentry認證規則所保護的一個對象，包括 server, database, table, URI, collection, and config

2.role 訪問給定object的規則集合

3.privilege 包括insert select update等

4.user 來自于能夠訪問Sentry服務的一個認證系統用戶，user可以是Kerberos的principal, LDAP的userid，或其他認證系統的標識

5.group 組，一個或者多個用戶的集合，Sentry中將role分配給group，一個組就相應擔當某個角色

6.A configured group provider determines a user’s affiliation with a group. The current release supports HDFS-backed groups and locally configured groups.

PrivilegeObject
INSERTDB, TABLE
SELECTSERVER, DB, TABLE, COLUMN
UPDATECOLLECTION, CONFIG
QUERYCOLLECTION, CONFIG
ALLSERVER, TABLE, DB, URI, COLLECTION, CONFIG

Sentry權限模型：

Sentry使用基于角色權限模型，有如下特征

1、允許所有用戶執行show functions，show locks等

2、允許用戶看到那些有權限的tables,databases,collections，configs等

3、HiveQL執行例如LOAD，IMPORT等操作，需要用戶有相應URI的權限

4、賦予一個URI某個權限，其子目錄也遞歸賦予這個權限，所以只需將權限grant給一個父目錄

5、CDH 5.5引入Column級別的訪問控制，之前版本的如果要控制到列級別訪問，使用View，創建一個只包含有訪問權限Column的View

Tips

    Hive中使用Sentry的時候，必須使用Beeline方式執行查詢，Hive Cli方式不支持Sentry

Hive On Sentry中Object層級結構關系

權限能夠賦予層級中的不同的object，一個權限如果賦予層級中一個object，則這個object子層級中的object繼承這個權限。

比如賦予DATABASE的SELECT權限給用戶A，則用戶A擁有DATABASE下所有Object的SELECT權限

【總結】Apache Sentry 服務簡介

權限類型和Object的對應關系

PrivilegeObject
INSERTDB, TABLE
SELECTDB, TABLE, VIEW, COLUMN
ALLSERVER, TABLE, DB, URI

權限層級

Base ObjectGranular privileges on objectContainer object that contains the base objectPrivileges on container object that implies privileges on the base object
DATABASEALLSERVERALL
TABLEINSERTDATABASEALL
TABLESELECTDATABASEALL
COLUMNSELECTDATABASEALL
VIEWSELECTDATABASEALL

Hive&Impala操作權限表

OperationScopePrivileges RequiredURI
CREATE DATABASESERVERALL
DROP DATABASEDATABASEALL
CREATE TABLEDATABASEALL
DROP TABLETABLEALL
CREATE VIEW-This operation is allowed if you have column-level SELECTaccess to the columns being used.DATABASE; SELECT on TABLE;ALL
ALTER VIEW-This operation is allowed if you have column-level SELECTaccess to the columns being used.VIEW/TABLEALL
DROP VIEWVIEW/TABLEALL
ALTER TABLE .. ADD COLUMNSTABLEALL
ALTER TABLE .. REPLACE COLUMNSTABLEALL
ALTER TABLE .. CHANGE columnTABLEALL
ALTER TABLE .. RENAMETABLEALL
ALTER TABLE .. SET TBLPROPERTIESTABLEALL
ALTER TABLE .. SET FILEFORMATTABLEALL
ALTER TABLE .. SET LOCATIONTABLEALLURI
ALTER TABLE .. ADD PARTITIONTABLEALL
ALTER TABLE .. ADD PARTITION locationTABLEALLURI
ALTER TABLE .. DROP PARTITIONTABLEALL
ALTER TABLE .. PARTITION SET FILEFORMATTABLEALL
SHOW CREATE TABLETABLESELECT/INSERT
SHOW PARTITIONSTABLESELECT/INSERT
SHOW TABLES-Output includes all the tables for which the user has table-level privileges and all the tables for which the user has some column-level privileges.TABLESELECT/INSERT
SHOW GRANT ROLE-Output includes an additional field for any column-level privileges.TABLESELECT/INSERT
DESCRIBE TABLE-Output shows all columns if the user has table level-privileges or SELECT privilege on at least one table columnTABLESELECT/INSERT
LOAD DATATABLEINSERTURI
SELECT-You can grant the SELECT privilege on a view to give users access to specific columns of a table they do not otherwise have access to.
-See Column-level Authorization for details on allowed column-level operations.		VIEW/TABLE; COLUMNSELECT
INSERT OVERWRITE TABLETABLEINSERT
CREATE TABLE .. AS SELECT-This operation is allowed if you have column-level SELECTaccess to the columns being used.DATABASE; SELECT on TABLEALL
USE <dbName>Any

CREATE FUNCTIONSERVERALL
ALTER TABLE .. SET SERDEPROPERTIESTABLEALL
ALTER TABLE .. PARTITION SET SERDEPROPERTIESTABLEALL
Hive-Only Operations
INSERT OVERWRITE DIRECTORYTABLEINSERTURI
Analyze TABLETABLESELECT + INSERT
IMPORT TABLEDATABASEALLURI
EXPORT TABLETABLESELECTURI
ALTER TABLE TOUCHTABLEALL
ALTER TABLE TOUCH PARTITIONTABLEALL
ALTER TABLE .. CLUSTERED BY SORTED BYTABLEALL
ALTER TABLE .. ENABLE/DISABLETABLEALL
ALTER TABLE .. PARTITION ENABLE/DISABLETABLEALL
ALTER TABLE .. PARTITION.. RENAME TO PARTITIONTABLEALL
MSCK REPAIR TABLETABLEALL
ALTER DATABASEDATABASEALL
DESCRIBE DATABASEDATABASESELECT/INSERT
SHOW COLUMNS-Output for this operation filters columns to which the user does not have explicit SELECT accessTABLESELECT/INSERT
CREATE INDEXTABLEALL
DROP INDEXTABLEALL
SHOW INDEXESTABLESELECT/INSERT
GRANT PRIVILEGEAllowed only for Sentry admin users

REVOKE PRIVILEGEAllowed only for Sentry admin users

SHOW GRANTAllowed only for Sentry admin users

SHOW TBLPROPERTIESTABLESELECT/INSERT
DESCRIBE TABLE .. PARTITIONTABLESELECT/INSERT
ADD JARNot Allowed

ADD FILENot Allowed

DFSNot Allowed

Impala-Only Operations
EXPLAINTABLE; COLUMNSELECT
INVALIDATE METADATASERVERALL
INVALIDATE METADATA <table name>TABLESELECT/INSERT
REFRESH <table name> or REFRESH <table name> PARTITION (<partition_spec>)TABLESELECT/INSERT
DROP FUNCTIONSERVERALL
COMPUTE STATSTABLEALL

通過HUE管理Sentry:http://10120275.blog.51cto.com/10110275/1956777

當前文章：【總結】ApacheSentry服務簡介
分享網址：http://m.newbst.com/article16/gscpdg.html

成都網站建設公司_創新互聯，為您提供定制開發、軟件開發、自適應網站、小程序開發、品牌網站設計、網站內鏈

廣告

聲明：本網站發布的內容（圖片、視頻和文字）以用戶投稿、用戶轉載內容為主，如果涉及侵權請盡快告知，我們將會在第一時間刪除。文章觀點不代表本網站立場，如需處理請聯系客服。電話：028-86922220；郵箱：631063699@qq.com。內容未經允許不得轉載，或轉載時需注明來源： 創新互聯

網站托管運營