Enabling Sentry Service Authorization

services: [HDFS, YARN, ZOOKEEPER, HIVE, OOZIE, HUE, IMPALA, SENTRY]

cluster { 
...
  databases {          
      SENTRY: {            
        type: mysql            
        host: sentry.db.example.com            
        port: 3306          
        user: <database_username>            
        password: <database_password>           
        name: <database_name>        
      }    
  }
}

• MapReduce: Set the Minimum User ID for Job Submission property to zero (the default is 1000) for every TaskTracker role group that is associated with Hive.

  MAPREDUCE {
      TASKTRACKER {                
          taskcontroller_min_user_id: 0 
      }         
  }

• YARN: Ensure that the Allowed System Users property, for every NodeManager role group that is associated with Hive, includes the hive user.

  YARN { 
      NODEMANAGER {           
          container_executor_allowed_system_users: hive, impala, hue 
      }         
  }

• HDFS: Enable HDFS extended ACLs.

  HDFS {             
      dfs_permissions: true   
      dfs_namenode_acls_enabled: true       
  }

  With Cloudera Manager 5.3 and CDH 5.3, you can enable synchronization of HDFS and Sentry permissions for HDFS files that are part of Hive tables. For details on enabling this feature using Cloudera Manager, see Synchronizing HDFS ACLs and Sentry Permissions.
• Hive: Make sure Sentry policy file authorization has been disabled for Hive.

  HIVE {            
      sentry_enabled: false          
  }

• Impala: Make sure Sentry policy file authorization has been disabled for Impala.

  IMPALA {            
      sentry_enabled: false           
  }