OPA Authorization for Hive Metastore (HMS)

Describes the procedure to enable OPA-authorization for HMS.

For Data Lakehouse - Spark and Presto Integration, Hive Metastore (HMS) needs authorization from OPA, to reuse the policies defined for datalakehouse catalog.

Enabling OPA Authorization for HMS

As cluster administrator (mapr user), do the steps that follow:
  1. Add OPAMetaStoreAuthorizer in HIVE_HOME/conf/hive-site.xml file:
    <property>
            <name>hive.metastore.pre.event.listeners</name>
            <value>org.apache.hadoop.hive.ql.security.authorization.plugin.metastore.opa.OPAMetaStoreAuthorizer</value>
            <description>Comma separated list of listeners to be invoked before metastore events</description>
        </property>
  2. Add OPA endpoint under hive.metastore.opa.url in HIVE_HOME/conf/hive-site.xml file:
    <property>
            <name>hive.metastore.opa.url</name>
            <value>OPA_endpoint</value>
            <description>URL for OPA endpoint</description>
        </property>
  3. Restart the HMS by either of the following ways:
    • Re-configure by running /opt/mapr/server/configure.sh -R command. Or
    • Restart only HMS by running /opt/mapr/bin/maprcli node services -name hivemeta -action restart -nodes hostname command.
    After this, HMS performs authorization check before processing its events.

Disabling OPA Authorization HMS

To disable OPA authorization for HMS, remove OPAMetaStoreAuthorizer in HIVE_HOME/conf/hive-site.xml file:
<property>
            <name>hive.metastore.pre.event.listeners</name>
            <value>org.apache.hadoop.hive.ql.security.authorization.plugin.metastore.opa.OPAMetaStoreAuthorizer</value>
            <description>Comma separated list of listeners to be invoked before metastore events</description>
        </property>