MaxCompute permission errors in Hologres

Hologres accesses MaxCompute data through foreign tables. Permissions for MaxCompute tables are managed on the MaxCompute side by the MaxCompute administrator. When a permission error occurs, you typically need to grant or modify permissions in MaxCompute.

Summary of issues

The following list summarizes the common MaxCompute permission errors in Hologres and links to their solutions.

• You have NO privilege 'odps:Select' on xxx when querying a foreign table

• The sensitive label of column 'xxx' is 2, but your effective label is 0

• You have NO privilege 'odps:Select' on xxx when accessing a table across projects

• You have NO privilege 'odps:List' on xxx when creating a foreign table

• Access denied by project ip white list when creating a foreign table

• You don't exist in project xxx when creating a foreign table

Foreign table query fails: You have NO privilege 'odps:Select' on xxx

Problem

After you create a foreign table in the Hologres console, you query the foreign table and the following error is returned: You have NO privilege 'odps:Select' on xxx.

Cause

The current account does not have the SELECT permission on the MaxCompute table.

Solution

Ask the MaxCompute administrator to grant the SELECT permission on the table to the current account in MaxCompute. For more information, see Grant permissions in MaxCompute.

After the permission is granted, query the foreign table again to verify that the error no longer occurs.

Foreign table query fails: The sensitive label of column 'xxx' is 2, but your effective label is 0

Problem

After you create a foreign table in the Hologres console, you query the foreign table and the following error is returned: The sensitive label of column 'xxx' is 2, but your effective label is 0.

Cause

The current account has permissions on only some columns of the MaxCompute table.

Solution

You can use one of the following methods to resolve this issue:

• (Recommended) Upgrade your Hologres instance to V0.8 or later. This is the preferred solution if your instance supports the upgrade. Search for and join the Hologres user group to request an upgrade. For more information, see Join the Hologres user group.

• If you cannot upgrade your instance, add the following parameters before the query that you run.

set hg_experimental_enable_odps_executor=on; 
set hg_experimental_enable_query_master=on;

• If you can obtain permissions on all columns, ask the MaxCompute administrator to grant full column access to the current account. For more information, see Grant permissions in MaxCompute.

  After you apply the selected method, query the foreign table again to confirm that the query succeeds.

Cross-project access fails: You have NO privilege 'odps:Select' on xxx

Problem

The current account already has the SELECT permission on the MaxCompute table, but the following error is returned when the account accesses the MaxCompute table across projects: You have NO privilege 'odps:Select' on xxx.

Cause

The current account has the SELECT permission on the MaxCompute table, but cross-project access still fails. This occurs when MaxCompute uses project-based authorization for cross-project access.

Solution

If MaxCompute uses project-based authorization, add the following SET statements before your SQL statement in Hologres. Replace <holoprojectname> with the name of your Hologres project.

-- For a V0.7 instance, run the following statement to grant permissions
set seahawks.seahawks_internal_current_odps_project='<holoprojectname>';
-- For a V0.8 instance, run the following statement to grant permissions
set hg_experimental_odps_current_project_name = '<holoprojectname>';

After you add the SET statement, run the cross-project query again to verify that the error no longer occurs.

Foreign table creation fails: You have NO privilege 'odps:List' on xxx

Problem

When you use HoloWeb or DataStudio in the Hologres console to create a foreign table through the visual interface, the following error is returned: You have NO privilege 'odps:List' on xxx.

Cause

The current account does not have the LIST permission to view all tables in MaxCompute.

Solution

• Ask the MaxCompute administrator to grant the current account the LIST permission to view all tables in MaxCompute. For more information, see Grant permissions in MaxCompute.

• Use SQL statements to create a foreign table and query data instead of the visual interface. For more information, see Create a foreign table by using SQL.

  After you apply the selected method, retry creating the foreign table to verify that the error no longer occurs.

Foreign table creation fails: Access denied by project ip white list

Problem

When you use HoloWeb in the Hologres console to create a foreign table, the following error is returned: Access denied by project ip white list: sourceIP:'xxxx' is not in white list. project: xxxx.

Cause

The current MaxCompute project is configured for whitelist-based access, and HoloWeb is not in the whitelist.

Solution

When the IP whitelist feature is enabled for a MaxCompute project, only IP addresses in the whitelist can access the project. Even with a valid AccessKey ID and AccessKey secret, requests from IP addresses not in the whitelist are rejected. Add the IP address from the error message to the MaxCompute project whitelist. For more information, see Configure an IP address whitelist.

After the IP address is added to the whitelist, retry creating the foreign table to verify that the error no longer occurs.

Foreign table creation fails: You don't exist in project xxx

Problem

When you create a foreign table, the following error is returned: You don't exist in project xxx.

Cause

The account that creates the foreign table does not have permission to access the specified MaxCompute project.

Solution

Verify the name of the MaxCompute project that you want to access. If the project name is incorrect, use the correct project name. If the project name is correct but the error persists, grant the account in the error message permission to access the MaxCompute project. For more information, see Add a user to a MaxCompute project.

After the permission is granted, retry creating the foreign table to verify that the error is resolved.