Enabling Sentry Service Authorization

For this method, you use the Altus Director client and the bootstrap-remote command to send a configuration file to the Altus Director server to deploy clusters. See Submitting a Cluster Configuration File for more details. Make sure you add SENTRY to the array of services to be launched. This is specified in the configuration file as:

services: [HDFS, YARN, ZOOKEEPER, HIVE, OOZIE, HUE, IMPALA, SENTRY]

To specify a database, use the databases setting as follows:

cluster { 
...
  databases {          
      SENTRY: {            
        type: mysql            
        host: sentry.db.example.com            
        port: 3306          
        user: <database_username>            
        password: <database_password>           
        name: <database_name>        
      }    
  }
}

The Sentry service also requires the following custom configuration for the MapReduce, YARN, HDFS, Hive, and Impala Services.

• MapReduce: Set the Minimum User ID for Job Submission property to zero (the default is 1000) for every TaskTracker role group that is associated with Hive.

  MAPREDUCE {
      TASKTRACKER {                
          taskcontroller_min_user_id: 0 
      }         
  }

• YARN: Ensure that the Allowed System Users property, for every NodeManager role group that is associated with Hive, includes the hive user.

  YARN { 
      NODEMANAGER {           
          container_executor_allowed_system_users: hive, impala, hue 
      }         
  }

• HDFS: Enable HDFS extended ACLs.

  HDFS {             
      dfs_permissions: true   
      dfs_namenode_acls_enabled: true       
  }

  With Cloudera Manager 5.3 and CDH 5.3, you can enable synchronization of HDFS and Sentry permissions for HDFS files that are part of Hive tables. For details on enabling this feature using Cloudera Manager, see Synchronizing HDFS ACLs and Sentry Permissions.
• Hive: Make sure Sentry policy file authorization has been disabled for Hive.

  HIVE {            
      sentry_enabled: false          
  }

• Impala: Make sure Sentry policy file authorization has been disabled for Impala.

  IMPALA {            
      sentry_enabled: false           
  }