The sentry service is a RPC server that stores the authorization metadata in the underlying relational database (eg Derby or MySQL). It provides RPC interfaces to retrieve and manipulate the privileges. It supports secure access to service using Kerberos. The downstream projects like Hive and Impala are client to this service. 

Note that the service is just for providing the metadata in the db backed storage. It does NOT handle the actual privilege validation.

Sentry service properties

Config propertyScopeValuesDefaultDescription
sentry.verify.schema.version

Service

true, falsetrue

Sentry store will verify the schema version in backed DB with expected version in jar.

The service won't start if there's a mismatch

sentry.service.server-max-threadsServiceNumber of threads500Max worker threads to serve client requests

sentry.service.server-min-threads

ServiceNumber of threads10Min worker threads to serve client requests
sentry.service.allow.connectServicecomma separated list of users-List of users that are allowed to connect to the service (eg Hive, Impala)
sentry.store.jdbc.urlServiceJDBC connection URL-JDBC connection URL for the backed DB
sentry.store.jdbc.userServiceuser nameSentryUserid for connecting to backend db
sentry.store.jdbc.passwordServicepasswordSentrypassword for backend JDBC user
sentry.service.server.keytabServiceKeytab file-Keytab for service principal
sentry.service.server.rpc-portServicePort #8038TCP port number for service
sentry.service.server.rpc-addressServiceTCP bind address0.0.0.0TCP interface for service to bind to
sentry.store.jdbc.driverServiceBackend JDBC driverorg.apache.derby.jdbc.EmbeddedDriver (only when dbtype = derby)JDBC Driver class for the backed DB
sentry.service.admin.groupServiceComma separates list of groups List of groups allowed to make policy updates
sentry.store.group.mappingService
org.apache.sentry.provider.common.HadoopGroupMappingService
org.apache.sentry.provider.common.HadoopGroupMappingServiceGroup mapping class for Sentry service.
org.apache.sentry.provider.file.LocalGroupMappingService can be used for local group mapping. 
sentry.store.group.mapping.resourceServicePolicy file for group mapping Policy file path for local group mapping, when sentry.store.group.mapping is set to LocalGroupMappingService class.
sentry.service.security.modeBothkerberos, nonekerberosAuthentication mode for Sentry service. Currently supports Kerberos and trusted mode

sentry.service.server.principal

BothKerberos principal Service Kerberos principal
sentry.service.client.server.rpc-addressClientTCP address of the server-TCP address of the sentry store server
sentry.service.client.server.rpc-portClientPort # of the server-Port # of the sentry store server
sentry.service.client.server.rpc-connection-timeoutClienttimeout200000RPC connection timeout in milisecs
sentry.metastore.service.usersClientcomma separated list of users List of service users (eg hive, impala) to bypass the Sentry metastore authorization. These services handle the metadata authorization on their side.
Some common client properties same as file based provider (deprecated names in bracket) Note: Some might need an update SENTRY-295    
sentry.provider (hive.sentry.provider)
Client
org.apache.sentry.provider.file.HadoopGroupResourceAuthorizationProvider
  
org.apache.sentry.provider.common.HadoopGroupResourceAuthorizationProviderGroup mapping which should be used at client side
sentry.hive.server (hive.sentry.server)
Clientlike "server1"-Hive Server2 Server identifier like "server1"
sentry.hive.provider.backend
Client
org.apache.sentry.provider.db.SimpleDBProviderBackend
org.apache.sentry.provider.file.SimpleFileProviderBackend
org.apache.sentry.provider.file.SimpleFileProviderBackend
Privilege provider to be used, we support file based or db based

Sentry policy store service config file: (sentry-site.xml)

  <property>
    <name>sentry.service.security.mode</name>
    <value>none</value>
  </property>
  <property>
    <name>sentry.service.admin.group</name>
    <value>admin1</value>
  </property>
  <property>
    <name>sentry.service.allow.connect</name>
    <value>impala,hive</value>
  </property>
  <property>
    <name>sentry.store.jdbc.url</name>
    <value>jdbc:derby:;databaseName=metastore_db;create=true</value>
  </property>

  <property>
    <name>sentry.store.jdbc.driver</name>
    <value>org.apache.derby.jdbc.EmbeddedDriver</value>
  </property>

Sentry policy store client config file: (sentry-site.xml)

   <property>
    <name>sentry.service.client.server.rpc-port</name>
    <value>3893</value>
  </property>
  <property>
    <name>sentry.service.client.server.rpc-address</name>
    <value>hostname</value>
  </property>
  <property>
    <name>sentry.service.client.server.rpc-connection-timeout</name>
    <value>200000</value>
  </property>
<!-- Properties required for setting the DB provider-->
  <property>
    <name>sentry.hive.provider.backend</name>
    <value>org.apache.sentry.provider.db.SimpleDBProviderBackend</value>
  </property>
  <property>
    <name>sentry.service.security.mode</name>
    <value>none</value>
  </property>

Properties required on Hive to talk to Sentry policy store service: (hive-site.xml)

 

<configuration>
  <property>
    <name>hive.security.authorization.task.factory</name>
    <value>org.apache.sentry.binding.hive.SentryHiveAuthorizationTaskFactoryImpl</value>
  </property>

Properties required on Metastore to talk to Sentry policy store service: (hive-site.xml)

 

<property>
<name>hive.metastore.pre.event.listeners</name>
<value>org.apache.sentry.binding.metastore.MetastoreAuthzBinding</value>
<description>list of comma seperated listeners for metastore events.</description>
</property>

 

Starting service :

  1. Set HADOOP_HOME
  2. Create DB schema for Sentry using Sentry schema tool.

    A built in way to deploy the backed DB schema required for Sentry service. Note that Sentry service by default doesn't initialize the schema. For the initial deployment, you need to run the schematool to initialize the schema. Alternately you can set the service side config property sentry.verify.schema.version to false.

    For database other than Derby, implicit deployment is not a good choice. Following option initializes the backend db schema

     

    bin/sentry --command schema-tool --conffile <sentry-site.xml> --dbType derby --initSchema
  3. Start Sentry service

    bin/sentry --command service --conffile <sentry-site.xml>
  • No labels