FAILED: SemanticException No valid privileges User p55_u33_userchk does not have privileges for LOAD

最新推荐文章于 2024-09-05 16:41:23 发布

原创最新推荐文章于 2024-09-05 16:41:23 发布 · 7.9k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#sentry #hive #权限 #load #hadoop

hive 专栏收录该内容

6 篇文章

订阅专栏

本文详细解析了在大数据平台使用Sentry进行权限控制时遇到的LOAD操作权限问题，并提供了具体的解决步骤，包括通过beeline连接hive库，查找对应角色，以及如何正确地为角色授予目录权限。

场景：大数据平台使用sentry做权限控制。使用代理用户从后台直接在hdfs上创建了目录/sap/webservice,将数据put到此目录,然后load数据到hive表中报错如下：

Caused by: org.apache.hive.service.cli.HiveSQLException: Error while compiling statement: FAILED: SemanticException No valid privileges
 User p55_u33_userchk does not have privileges for LOAD
 The required privileges: Server=server1->URI=hdfs://XXX/sap/webservice/Bankage_2019-10-30->action=*;
	at org.apache.hive.service.cli.operation.Operation.toSQLException(Operation.java:374)
	at org.apache.hive.service.cli.operation.SQLOperation.prepare(SQLOperation.java:136)
	at org.apache.hive.service.cli.operation.SQLOperation.runInternal(SQLOperation.java:206)
	at org.apache.hive.service.cli.operation.Operation.run(Operation.java:316)
	at org.apache.hive.service.cli.session.HiveSessionImpl.executeStatementInternal(HiveSessionImpl.java:430)
	at org.apache.hive.service.cli.session.HiveSessionImpl.executeStatementAsync(HiveSessionImpl.java:405)
	at org.apache.hive.service.cli.CLIService.executeStatementAsync(CLIService.java:258)
	at org.apache.hive.service.cli.thrift.ThriftCLIService.ExecuteStatement(ThriftCLIService.java:506)
	at org.apache.hive.service.cli.thrift.TCLIService$Processor$ExecuteStatement.getResult(TCLIService.java:1313)
	at org.apache.hive.service.cli.thrift.TCLIService$Processor$ExecuteStatement.getResult(TCLIService.java:1298)
	at org.apache.thrift.ProcessFunction.process(ProcessFunction.java:39)
	at org.apache.thrift.TBaseProcessor.process(TBaseProcessor.java:39)
	at org.apache.hive.service.auth.TSetIpAddressProcessor.process(TSetIpAddressProcessor.java:56)
	at org.apache.thrift.server.TThreadPoolServer$WorkerProcess.run(TThreadPoolServer.java:286)
	... 3 more
Caused by: org.apache.hadoop.hive.ql.parse.SemanticException: No valid privileges
 User p55_u33_userchk does not have privileges for LOAD
 The required privileges: Server=server1->URI=hdfs://XXX/sap/webservice/Bankage_2019-10-30->action=*;
	at org.apache.sentry.binding.hive.HiveAuthzBindingHook.postAnalyze(HiveAuthzBindingHook.java:357)
	at org.apache.hadoop.hive.ql.Driver.compile(Driver.java:454)
	at org.apache.hadoop.hive.ql.Driver.compile(Driver.java:311)
	at org.apache.hadoop.hive.ql.Driver.compileInternal(Driver.java:1194)
	at org.apache.hadoop.hive.ql.Driver.compileAndRespond(Driver.java:1181)
	at org.apache.hive.service.cli.operation.SQLOperation.prepare(SQLOperation.java:134)
	... 15 more
Caused by: org.apache.hadoop.hive.ql.metadata.AuthorizationException: User p55_u33_userchk does not have privileges for LOAD
	at org.apache.sentry.binding.hive.authz.HiveAuthzBinding.authorize(HiveAuthzBinding.java:343)
	at org.apache.sentry.binding.hive.authz.HiveAuthzBindingHookBase.authorizeWithHiveBindings(HiveAuthzBindingHookBase.java:483)
	at org.apache.sentry.binding.hive.HiveAuthzBindingHook.postAnalyze(HiveAuthzBindingHook.java:340)
	... 20 more

从报错上大概可以看出，是sentry权限问题。

解决方法：
1,beeline 到hive库
beeline -u jdbc:hive2://xxx.xxx.xxx.xxx:10000/
2,找到用户p55_u33_userchk对应的role:p55_u33_userchk_r1(一般都是该用户名+_r1)
show roles
3,将此目录赋权给该用户对应的role
grant all on uri 'hdfs://XXX/sap/webservice/' to role p55_u33_userchk_r1
4,搞定~