Control Hive data access with Ranger in DataWorks-DataWorks(DataWorks)-阿里云帮助中心

Overview

Integrating Apache Ranger in your EMR cluster with DataWorks Security Center enables fine-grained, traceable data access control for EMR Hive.

Core capabilities: Manage data access permissions for EMR Hive at the database level and table level.
Roles and responsibilities:
- Administrator (a DataWorks tenant administrator who also has management permissions on the EMR cluster): Configures technical settings, approves permission requests, and manages and audits data access for all developers.
- Developer (a regular RAM user): Accesses data and requests Hive data permissions through DataWorks Security Center without needing to understand the underlying implementation.
Key benefits: Separates configuration from usage. Administrators centrally manage data security, while developers request access as needed. This approach improves both data security and collaboration efficiency.

How it works

The process has two phases: one-time setup and day-to-day use. It involves two roles (administrator and developer) working across both the EMR and DataWorks platforms.

Phase 1: One-time administrator setup

Before users can request permissions, an administrator must complete all prerequisite configurations.

Prerequisites

On the EMR side
- Ensure that an EMR cluster has been created and that OpenLDAP authentication and the Ranger service are enabled.
- Ensure that the Hive service is configured for LDAP authentication (hive.server2.authentication=LDAP).
- Ensure that corresponding LDAP accounts have been created in OpenLDAP for all relevant users. For more information, see OpenLDAP user management.
- Ensure that the LDAP accounts have been added to the Ranger UI.
On the DataWorks side
- Ensure that the EMR cluster is registered as an EMR compute resource in your DataWorks workspace and that the resource group is initialized (the cluster and the resource group must be in the same VPC or have VPC connectivity).
- Configure account mapping for the EMR compute resource to map Alibaba Cloud accounts to LDAP accounts. For more information, see Configure cluster identity mapping.
- Ensure that you have DataWorks tenant administrator permissions.

Configuration workflow

Step	Role	Platform	Action
1	Administrator	DataWorks	Associate the cluster with Ranger: Add a Ranger configuration in DataWorks Security Center and associate it with the target EMR cluster.
2	Administrator	DataWorks	Associate the Hive service: In the Ranger configuration, add a Hive-type Ranger Service association.
3	Administrator	DataWorks	Configure identity mapping: Configure Hive identity credentials for RAM users to establish the mapping between RAM users and LDAP accounts.

Phase 2: Day-to-day use and approval for developers and Administrators

After setup is complete, the day-to-day permission request and approval cycle begins.

Step	Role	Platform	Action
1	Developer	DataWorks	Request permissions: In the Data Access Control module of DataWorks Security Center, request access permissions for the desired Hive database or table.
2	Administrator	DataWorks	Approve permissions: Approve the developer's permission request in DataWorks Security Center.
3	/	EMR	Permission provisioning: After approval, DataWorks automatically calls the Ranger API to generate the corresponding access policy in Ranger. (This step is triggered automatically.)
4	Developer	DataWorks	Use data: After the access policy takes effect, the developer can access authorized Hive data in modules such as Data Studio, Data Analysis, and Data Map.

Example overview

This example shows developer bob requesting SELECT permissions on the user_orders table in Hive from the administrator, demonstrating the complete configuration and usage process:

Role/Resource	Description
Administrator	RAM user alice@company.com, with LDAP account alice. The account type in identity credentials is set to Administrator (can approve permission requests in DataWorks Security Center).
Developer	RAM user bob@company.com, with LDAP account bob. The account type in identity credentials is set to Regular User.
EMR cluster	An EMR cluster with OpenLDAP, Hive LDAP authentication, and Ranger service enabled.
Hive Service	The Ranger Service Name is `emr-hive`.
Target data	A table named `user_orders` in the `order_db` database in EMR Hive.

Note

Throughout the entire process, the same LDAP account name must be used consistently in the following four places: the LDAP user in the EMR cluster, the user in the Ranger UI, the account name in DataWorks Security Center identity credentials, and the account mapping for the compute engine in DataWorks Administration. Identity credentials are used by DataWorks Security Center to identify user identities and manage permission approvals. Account mapping is used to convert user identities when DataWorks Administration submits compute tasks.

Administrator: Configure Hive data access control

The administrator must complete the following three configuration steps before developers can request and use Hive data permissions through DataWorks Security Center.

Step 1: Add a Ranger configuration

The Administrator must add a Ranger configuration in DataWorks Security Center to associate the EMR cluster with DataWorks. The configuration includes:

Cluster Type: Select EMR.
EMR Cluster ID: Select the EMR cluster that is registered in your DataWorks workspace.
Resource group: Select a general-purpose resource group that is in the same VPC as the EMR cluster.
RangerAdmin Address: Enter the internal access address of RangerAdmin in the EMR cluster.
Admin Account/Password: Enter the Ranger administrator account and password.

For detailed steps, see Add a Ranger configuration.

Step 2: Associate a Hive Service

After you add the Ranger configuration, add a Hive-type Service association so that DataWorks can manage Hive data access permissions through Ranger.

On the Security Center page, choose Security policy > Manage Ranger.
Click Management Service for the target Ranger configuration.

Click Add Association and configure the following information:

Parameter	Description
Ranger Service Type	Select Hive.
Ranger Service Name	Enter the name of the Hive Ranger Service that is configured in the EMR cluster. In this example, enter `emr-hive`.
EMR Cluster	Select the EMR cluster that is associated with the current Ranger configuration.

For detailed steps, see the Service association section in Add a Ranger configuration.

Step 3: Configure identity credentials

The Administrator must configure identity credentials for each RAM user who needs to access Hive data, mapping the RAM user to an LDAP account.

Important

The Account Name in the identity credentials must exactly match the username assigned to the user in the LDAP of the EMR cluster (for example, alice). This is the sole basis for Ranger to identify and authorize users.
We recommend using the same name as the Alibaba Cloud RAM account for easier management.

In this example, the Administrator must configure identity credentials for both alice and bob:

Configure identity credentials for Administrator alice:

Parameter	Example value
Alibaba Cloud RAM user/Role	alice@company.com
Data Source Type	Hive
Cluster/Instance	Select the EMR cluster with Ranger configured.
Account Type	Administrator. An Administrator can approve permission requests from other users.
Account Name	alice (must match the LDAP account name in the EMR cluster)
Account password	Enter the password for the LDAP account alice.

Configure identity credentials for developer bob:

Parameter	Example value
Alibaba Cloud RAM user/Role	bob@company.com
Data Source Type	Hive
Cluster/Instance	Select the EMR cluster with Ranger configured (the same cluster as alice).
Account Type	Regular User. A regular user can only request permissions, not approve them.
Account Name	bob (must match the LDAP account name in the EMR cluster)
Account password	Enter the password for the LDAP account bob.

For detailed steps, see Identity credentials.

Developer: Request Hive data access permissions

After the administrator completes the preceding configuration, developer bob can request Hive data access permissions in DataWorks Security Center.

Step 1: Go to data access control

Log on to the DataWorks console and go to the target workspace. In the left-side navigation pane, choose Data Governance > Security Center.
On the Security Center page, click Data Access Control in the left-side navigation pane.

Step 2: Request permissions

On the Data Access Control page, submit a permission request. Configure the Application Content and Application information sections.

Note

Hive permission requests do not support custom approval workflows or permission audit management.
Hive permission requests can only be reviewed by RAM users or RAM roles whose account type is set to Administrator in the identity credentials.

On the Data Access Control page, click the Permission Application tab.

Request resource permissions.

In the Application Content section, set the data source type to Hive to configure the request.
1. Application Type: Select Database or Table as needed. In this example, select Table.
2. EMR Cluster: Select the EMR cluster instance that is associated with your DataWorks workspace.
3. Select the resources and resource permissions to request.
  
  When Application Type is set to Table, first select a database (in this example, order_db). The system automatically loads all tables in that database for which you can request permissions. Select the table for which you want to request permissions (in this example, user_orders) and the table permissions (in this example, SELECT).
  
  When Application Type is set to Database, the Application Content section loads the names of Hive databases for which you can request permissions. Select the databases and the database permissions (such as SELECT or ALL) that you want to request.

Configure the application information.

Parameter	Description
User	Select the user for whom you want to request permissions on the target resource. Current login account: Request permissions for the Alibaba Cloud account that is currently logged on to the DataWorks workspace. In this example, bob selects this option. Apply on Behalf of Others: The Alibaba Cloud account that is currently logged on to the DataWorks workspace requests permissions on behalf of another Alibaba Cloud account. If you select this option, you must configure the Username parameter.
Application duration	Hive only supports: Permanent.
Reason for Application	Enter the reason for the permission request. In this example, bob enters "Need to query data from the user_orders table in the order_db database for data analysis".

After the configuration is complete, click Apply for Permissions to submit the request.

Administrator : Approve permissions

After developer bob submits the permission request, the RAM user whose account type is set to Administrator in the identity credentials (in this example, alice@company.com) approves the request in Security Center.

View pending requests.

In the left-side navigation pane, choose Application & Approval > My Approval Tasks, and click the Data Access Control tab. Set Data Source Type to Hive to view the permission request submitted by bob.

Note
Only RAM users or RAM roles whose account type is set to Administrator in the identity credentials have the approval permission. In this example, only alice (administrator type) can approve requests.
View the approval details.

In the Operation column of the target request, click Approval. In the Approval details dialog, you can view the Application Details, Approval record, and other details of the target request.
Approve the request.

Based on the request details and current requirements, determine whether to approve the request. Enter Approval Comments, and click Agree or Reject for the current request.

You can also select all requests on the My Approval Tasks page and click Batch Agree or Batch Reject. Enter Approval Comments and process the target requests in batch.

Note

After administrator alice approves the request, Ranger automatically generates the corresponding policy in the EMR cluster. Developer bob can then access data in the order_db.user_orders table through DataWorks.

View permission request and approval records

View permission request records: In the left-side navigation pane, choose Application & Approval > My Applications, and click the Data Access Control tab. You can filter by data source type Hive to view Hive permission request records submitted by the current account.
View permission approval records: In the left-side navigation pane, choose Application & Approval > My Approval Tasks, and click the Data Access Control tab. Switch the task status to All and filter by data source type Hive to view Hive permission requests that have been approved by the current account.

Note

Hive permission request records support withdrawal (only for requests in Pending Approval status). Renewal is not supported.
The Permission Audit tab on the Data Access Control page currently supports only MaxCompute. Permission audit for Hive is not available on this tab.
The original Permission Approval Records tab on the Data Access Control page has been removed, and only a migration notice is displayed. Go to Application & Approval > My Approval Tasks to view approval records.