Page History

...

In use cases 1 and 2a, the users have direct access to the data. Hive configurations don't control the data access. The HDFS permissions act as one source of truth for the table storage access. By enabling Storage Based Authorization in the metastore server, you can use this single source for truth and have a consistent data and metadata authorization policy. To control metadata access on the metadata objects such as Databases, Tables and Partitions, it checks if you have permission on corresponding directories on the file system. You can also protect access through HiveServer2 (use case 2b above) by ensuring that the queries run as the end user (ensure hive.server2.enable.doAs= option should be "true" in HiveServer2 configuration – this is the a default configurationvalue).

Note that through the use of HDFS ACL (available in Apache Hadoop 2.4 onwards) you have a lot of flexibility in controlling access to the file system, which in turn provides more flexibility with Storage Based Authorization. Also, note that you need the upcoming Hive 0.14 release to make use of the flexibility provided through HDFS ACL (HIVE-7583).

...