思考

看了hive配置权限管理的方式之后发现，其实之前修改的Operation2Privilege是为权限管理类SQLStdHiveAuthorizerFactory服务的，那么是否可以用aux的方式把一整套的SQLStdHiveAuthorizerFactory的代码全都替换掉呢。

分析配置和代码

SQL Standard Based Hive Authorization官网给出的权限配置方式中需要进行以下配置

-hiveconf hive.security.authorization.manager=org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLStdHiveAuthorizerFactory

查看该类的源码

package org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd;import org.apache.hadoop.hive.common.classification.InterfaceAudience.Private;
import org.apache.hadoop.hive.conf.HiveConf;
import org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizer;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizerFactory;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthorizerImpl;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzPluginException;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAuthzSessionContext;
import org.apache.hadoop.hive.ql.security.authorization.plugin.HiveMetastoreClientFactory;@Private
public class SQLStdHiveAuthorizerFactory implements HiveAuthorizerFactory{@Overridepublic HiveAuthorizer createHiveAuthorizer(HiveMetastoreClientFactory metastoreClientFactory,HiveConf conf, HiveAuthenticationProvider authenticator, HiveAuthzSessionContext ctx) throws HiveAuthzPluginException {SQLStdHiveAccessControllerWrapper privilegeManager =new SQLStdHiveAccessControllerWrapper(metastoreClientFactory, conf, authenticator, ctx);return new HiveAuthorizerImpl(privilegeManager,new SQLStdHiveAuthorizationValidator(metastoreClientFactory, conf, authenticator,privilegeManager, ctx));}
}

很简单，只是对SQLStdHiveAuthorizationValidator的一个封装 接下来查看SQLStdHiveAuthorizationValidator类 该类也不是很复杂，只有150+行代码，下面给出关键代码checkPrivileges方法：

private void checkPrivileges(HiveOperationType hiveOpType, List<HivePrivilegeObject> hiveObjects,IMetaStoreClient metastoreClient, String userName, IOType ioType, List<String> deniedMessages)throws HiveAuthzPluginException, HiveAccessControlException {if (hiveObjects == null) {return;}// Compare required privileges and available privileges for each hive objectfor (HivePrivilegeObject hiveObj : hiveObjects) {RequiredPrivileges requiredPrivs = Operation2Privilege.getRequiredPrivs(hiveOpType, hiveObj,ioType);if(requiredPrivs.getRequiredPrivilegeSet().isEmpty()){// no privileges required, so don't need to check this object privilegescontinue;}// find available privilegesRequiredPrivileges availPrivs = new RequiredPrivileges(); //start with an empty priv set;switch (hiveObj.getType()) {case LOCAL_URI:case DFS_URI:availPrivs = SQLAuthorizationUtils.getPrivilegesFromFS(new Path(hiveObj.getObjectName()),conf, userName);break;case PARTITION:// sql std authorization is managing privileges at the table/view levels// only// ignore partitionscontinue;case COMMAND_PARAMS:case FUNCTION:// operations that have objects of type COMMAND_PARAMS, FUNCTION are authorized// solely on the typeif (privController.isUserAdmin()) {availPrivs.addPrivilege(SQLPrivTypeGrant.ADMIN_PRIV);}break;default:availPrivs = SQLAuthorizationUtils.getPrivilegesFromMetaStore(metastoreClient, userName,hiveObj, privController.getCurrentRoleNames(), privController.isUserAdmin());}// Verify that there are no missing privilegesCollection<SQLPrivTypeGrant> missingPriv = requiredPrivs.findMissingPrivs(availPrivs);SQLAuthorizationUtils.addMissingPrivMsg(missingPriv, hiveObj, deniedMessages);}}

12行RequiredPrivileges requiredPrivs = Operation2Privilege.getRequiredPrivs(hiveOpType, hiveObj, ioType);这里就发现了之前修改源码的Operation2Privilege类，而且Operation2Privilege也只在这个地方调用。至此庆幸问题不算很复杂，只要把这三个类抽出来，然后把Operation2Privilege按照需要的需求改一下权限就好了。Operation2Privilege的修改见前一篇文章hive SQL Standard Based Hive Authorization 权限自定义

修改

最后结构就是这样的

这里其实只有一个Operation2PrivilegeCustomer是要按照需求修改代码的，另外的SQLStdHiveAuthorizerFactoryCustomer和SQLStdHiveAuthorizationValidatorCustomer代码与原始代码一致，只是里面的涉及到的SQLStdHiveAuthorizationValidator和Operation2Privilege全要换成我们带Customer的类了。

PS：由于原来的一些调用方法是protect的，所以这里的包路径要跟原来的包路径一致才不会出问题。

配置

修改好了之后自然是打一个包，然后把这个包的上传到hiveserver2服务器上，然后修改hive-site.xml 的

<property><name>hive.aux.jars.path</name><value>file:///my/aux/path/hive-authorizer.jar</value>
</property>

以及修改hiveserver2-site.xml的

<property><name>hive.security.authorization.manager</name><value>org.apache.hadoop.hive.ql.security.authorization.plugin.sqlstd.SQLStdHiveAuthorizerFactoryCustomer</value><description>the hive client authorization manager class name.</description>
</property>

修改为自己重写的类 然后重启一下hiveserver2就可以了，这样的话，hive更新版本，是要拷贝配置文件和该jar包就可以了，无需修改源码重新编译，也降低了耦合性。