Overview
Authorization is concerned with who or what has access or control over a given
resource or service. Since Hadoop merges together the capabilities of
multiple varied, and previously separate IT systems as an enterprise data
hub that stores and works on all data within an organization, it requires
multiple authorization controls with varying granularities. In such cases,
Hadoop management tools simplify setup and maintenance by:
- Tying all users to groups, which can be specified in existing LDAP or AD directories.
- Providing role-based access control for similar interaction methods, like batch and interactive SQL queries. For example, Apache Ranger permissions apply to Hive (HiveServer2) and Impala.
CDP currently provides the following forms of access control:
- Traditional POSIX-style permissions for directories and files, where each directory and file is assigned a single owner and group. Each assignment has a basic set of permissions available; file permissions are simply read, write, and execute, and directories have an additional permission to determine access to child directories.
- Apache HDFS ACLs provide fine-grained control of permissions for HDFS files by allowing you to set different permissions for specific named users or named groups.
- Apache HBase uses ACLs to authorize various operations (
READ, WRITE, CREATE, ADMIN) by column, column family, and column family qualifier. HBase ACLs are granted and revoked to both users and groups. - Access control with Apache Ranger.
