Method, device and storage medium for kerberos permission management

Abstract

The application discloses a permission management method and device for Kerberos and a storage medium, and relates to the field of user permission allocation.The method comprises the following steps: storing permission management information of a user in a Ranger permission service of the user; when it is monitored that the user accesses a hive database, it is judged whether the accessed hive database accords with the permission of the current user; if yes, the current user is allowed to use a Kerberos account; otherwise, the current user is prohibited from using the Kerberos account.The application stores the permission management information of the user in the Ranger permission service of the user, and then performs authentication through the Ranger permission service, so that the purpose of allowing the user who accords with the permission to use the Kerberos account and prohibiting the user who does not accord with the permission from using the Kerberos account is achieved.The application can perform permission management on the Kerberos account without increasing virtual machines, and thus resources can be greatly saved.

Description

Technical Field

[0001] This invention relates to the field of user permission allocation, and more specifically to a permission management method, device, and storage medium for Kerberos. Background Technology

[0002] Kerberos is an identity authentication protocol based on symmetric key technology. As an independent and reliable third-party identity authentication service, it can provide identity authentication functions for other services and supports SSO, which means that after the client is authenticated, it can access multiple services such as HBase / HDFS (distributed storage system).

[0003] The Kerberos principal is used to identify a unique identity within the Kerberos cryptographic system. `keytab` is a file containing principals and cryptographic principal keys. `krb5.conf` is the primary Kerberos configuration file, where you can configure the location of the KDC and the mapping of Kerberos domain hostnames.

[0004] Hadoop is an open-source distributed computing platform developed by the Apache Software Foundation.

[0005] Hive is a data warehouse tool based on Hadoop, used for data extraction, transformation, and loading. It is a mechanism that can store, query, and analyze large-scale data stored in Hadoop.

[0006] Enabling Kerberos authentication in Hive ensures that both communicating parties can verify each other's identities, preventing data from being tampered with or intercepted by unknown users or services. After enabling Kerberos, all Hive client connections must provide a valid Kerberos ticket, increasing security.

[0007] Apache Ranger is a comprehensive data security management framework for the Hadoop platform, providing full security management for the entire Hadoop ecosystem. Users can use Ranger to securely access data within the cluster; its primary functions include monitoring Hadoop platform components, starting services, and controlling resource access.

[0008] Currently, when business users relying on Ranger's permission management need to access Hive databases, the hive-jdbc driver is loaded in the JVM (Java Virtual Machine), a Kerberos account is selected, and the corresponding keytab file is loaded. Because the Kerberos account is logged in within the virtual machine, the permissions maintained in Ranger are not effective. For example, Ranger may specify that user A can only access Hive database X, but after user A is authenticated with their Kerberos account, they can actually access all Hive databases.

[0009] To solve the above problem, different permissions can be configured for different Kerberos accounts. However, since keytab and krb5.conf cannot be switched in a single virtual machine, a corresponding virtual machine is required for each Kerberos account to log in, which consumes a lot of resources. Summary of the Invention

[0010] To address the shortcomings of existing technologies, the technical problem solved by this invention is: how to manage the permissions of Kerberos accounts without adding virtual machines, thereby significantly saving resources.

[0011] To achieve the above objectives, in a first aspect, embodiments of this application provide a permission management method for Kerberos, comprising the following steps: storing the user's permission management information in the user's Ranger permission service; when a user accesses a Hive database, determining whether the accessed Hive database complies with the current user's permissions; if so, allowing the current user to use the Kerberos account; otherwise, prohibiting the current user from using the Kerberos account.

[0012] In conjunction with the first aspect, in one implementation, the process of storing the user's permission management information in the user's Ranger permission service includes: the business side creating a proxy user and synchronizing it to the Ranger permission service; configuring the proxy user's permission management information; and calling the Ranger permission service to store the proxy user's permission management information.

[0013] In conjunction with the first aspect, in one implementation, the process of determining whether the accessed Hive database complies with the current user's permissions when a user accesses the Hive database includes: configuring Kerberos account information for the proxy user and creating a Hive database connection object through the proxy user; determining the proxy user's permission management information in the Ranger permission service when the proxy user accesses the Hive database; and determining whether the Hive database to be accessed complies with the permissions based on the permission management information.

[0014] In conjunction with the first aspect, in one implementation, when the business side uses a proxy user to access the Hive database, the proxy user is appended to the connection path;

[0015] In the Java program, set the environment variable "java.security.krb5.conf", construct the Kerberos authentication Configuration object, and create a UserGroupInformation object;

[0016] Use the information in the authentication file to set the identity credentials, Kerberos user, and permission file for the UserGroupInformation object;

[0017] User authentication is performed by calling the UserGroupInformation object;

[0018] Returns a UserGroupInformation object that has been successfully verified;

[0019] Inject the UserGroupInformation object into the proxy user, and use the proxy user to create the Hive-Connection object.

[0020] Secondly, embodiments of this application provide a permission management system for Kerberos. This system is used to: store the user's permission management information in the user's Ranger permission service; when a user accesses a Hive database, determine whether the accessed Hive database meets the current user's permissions. If so, allow the current user to use the Kerberos account; otherwise, prohibit the current user from using the Kerberos account.

[0021] In conjunction with the second aspect, in one implementation, the process of storing the user's permission management information in the user's Ranger permission service includes: the business end creating a proxy user and synchronizing it to the Ranger permission service; configuring the proxy user's permission management information; and calling the Ranger permission service to store the proxy user's permission management information.

[0022] In conjunction with the second aspect, in one implementation, when the system detects a user accessing a Hive database, the process of determining whether the accessed Hive database complies with the current user's permissions includes: configuring Kerberos account information for the proxy user, creating a Hive database connection object through the proxy user; when the system detects the proxy user accessing the Hive database, determining the proxy user's permission management information in the Ranger permission service; and determining whether the Hive database to be accessed complies with permissions based on the permission management information.

[0023] In conjunction with the second aspect, in one implementation, the system specifically includes:

[0024] The proxy user configuration module is used for: creating proxy users and synchronizing them to the Ranger permission service; configuring the permission management information of proxy users and calling the Ranger permission service to store the permission management information of proxy users; and appending the proxy user to the connection path when a proxy user is detected accessing the Hive database.

[0025] The Kerberos login environment configuration module is used to: set the environment variable "java.security.krb5.conf" in Java programs and construct the Kerberos authentication Configuration object;

[0026] Create a UserGroupInformation object;

[0027] Use the information in the authentication file to set the identity credentials, Kerberos user, and permission file for the UserGroupInformation object;

[0028] User authentication is performed by calling the UserGroupInformation object;

[0029] Returns a UserGroupInformation object that has been successfully verified;

[0030] The database connection module is used to: inject UserGroupInformation objects into proxy users, and use the proxy users to create Hive-Connection connection objects.

[0031] Thirdly, embodiments of this application provide a permission management device for Kerberos, the permission management device for Kerberos including a processor, a memory, and a permission management program for Kerberos stored in the memory and executable by the processor, wherein when the permission management program for Kerberos is executed by the processor, it implements the method provided in the first aspect.

[0032] Fourthly, embodiments of this application provide a computer-readable storage medium storing a permission management program for Kerberos, wherein the computer program, when executed, implements the method provided in the first aspect.

[0033] Compared with the prior art, the advantages of the present invention are as follows:

[0034] This invention stores a user's permission management information in the Ranger permission service and then authenticates the user through the Ranger permission service. This allows authorized users to use Kerberos accounts while prohibiting unauthorized users from using them. Therefore, this invention avoids the problem of Ranger being unable to verify permissions when a Kerberos account logs into a Hive database. It breaks down the barrier between Hive and Kerberos users, using the Hive user as a proxy user and splitting the Hive database connection process into two parts, each with its own function. Only one Kerberos user is needed for account-wide permission control, decoupling permission control from the complexities of the Kerberos user interface.

[0035] Building upon this, compared to existing technologies that require loading a keytab file and using a Kerberos account and password to connect to a Kerberos-authenticated Hive database, this invention avoids the need to create a Kerberos user for each Hive user, avoids the problem of switching keytab and krb5.conf within the same JVM process, and eliminates the risks associated with switching Kerberos users. Only one Kerberos user with administrator privileges is needed for login authentication, and Hive user permission management is handled by Ranger, greatly simplifying the Hive permission authentication process. The Kerberos configuration can be loaded when the service starts.

[0036] Therefore, this invention can manage the permissions of Kerberos accounts without adding virtual machines, thereby significantly saving resources. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a schematic diagram illustrating the process of configuring users and permissions in an embodiment of the present invention;

[0039] Figure 2 This is a flowchart illustrating the permission management method for Kerberos in an embodiment of the present invention.

[0040] Figure 3 This is a schematic diagram of the hardware structure of the permission management device for Kerberos involved in the embodiments of this application. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0042] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0043] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0044] First, a brief description of the research and development process of this application will be given.

[0045] To manage Kerberos account permissions without adding virtual machines, business users could manually maintain Hive access permission data without relying on the Ranger permission service. This would involve accessing Hive using a specified Kerberos user and keytab file, intercepting the Hive-JDBC connection call before parsing the database and table names in the Hive-SQL statement, and checking the permission data to determine if permissions are granted. However, this approach significantly increases the development complexity on the business side, raises the risk of errors in parsing Hive-SQL, is overly cumbersome, difficult to maintain, and challenging to troubleshoot.

[0046] Based on this, in a first aspect, embodiments of this application provide a permission management method for Kerberos, comprising the following steps: storing the user's permission management information in the user's Ranger permission service; when a user accesses a Hive database, determining whether the accessed Hive database complies with the current user's permissions; if so, allowing the current user to use the Kerberos account; otherwise, prohibiting the current user from using the Kerberos account.

[0047] Therefore, this invention stores a user's permission management information in the user's Ranger permission service, and then uses the Ranger permission service for authentication to allow qualified users to use Kerberos accounts and prohibit unqualified users from using Kerberos accounts. Thus, this invention avoids the problem of Ranger being unable to perform permission verification when a Kerberos account logs into a Hive database, breaking down the barrier between Hive users and Kerberos users. By using the Hive user as a proxy user, the process of connecting to the Hive database is divided into two parts, each performing its own function. Only one Kerberos user is needed for account permission control, decoupling permission control from the complexities of the Kerberos user interface.

[0048] Building upon this, compared to existing technologies that require loading a keytab file and using a Kerberos account and password to connect to a Kerberos-authenticated Hive database, this invention only requires a single Kerberos account to achieve different permission management. This avoids the need to create a Kerberos user and a virtual machine for each Hive user, avoids the problem of switching keytab and krb5.conf within the same JVM process, and eliminates the risks associated with switching Kerberos users. Only a Kerberos user with administrator privileges is needed for login authentication, and Hive user permission management is handled by Ranger, greatly simplifying the Hive permission authentication process. The Kerberos configuration can be loaded when the service starts.

[0049] In one embodiment, the process of storing the user's permission management information in the user's Ranger permission service in the above method includes: See Figure 1 As shown, the business side creates (add, delete, modify users, etc.) proxy users and synchronizes them to the Ranger permission service; configures the permission management information of the proxy users (specific permissions and policies, such as granting users the right to query, modify, delete, and add users in the specified Hive database), and calls the Ranger permission service to store the permission management information of the proxy users.

[0050] Based on this, the process of determining whether the accessed Hive database complies with the current user's permissions when the above method detects user access to the Hive database includes: configuring Kerberos account information for the proxy user and creating a Hive database connection object through the proxy user; when the proxy user accesses the Hive database, determining the proxy user's permission management information in the Ranger permission service; and determining whether the Hive database to be accessed complies with permissions based on the permission management information.

[0051] For details, see Figure 2 As shown, the specific process of the above method includes:

[0052] Step 1: When the business side accesses the Hive database using a proxy user, append the proxy user to the hive-jdbc-url connection path. The key is "hive.server2.proxy.user=", and the value is the name of the proxy user (e.g., abc). An example of the completed concatenation is as follows:

[0053] jdbc:hive2: / / xxx.com:2181 / ; serviceDiscoveryMode=zooKeeper; zooKeeperNamespace=hiveserver2; auth=KERBEROS; principal=hive / _HOS T@xxx.COM; user.principal=xxx; user.keytab= / etc / user.keytab; hive.server2.proxy.user=abc;

[0054] Step 2: Construct a UserGroupInformation object. UserGroupInformation is an important class in Hadoop used to manage user identity information, permissions, and credentials. UserGroupInformation transmits user identity information between various components in the cluster for secure authentication and authorization operations.

[0055] Specifically, this involves setting the environment variable "java.security.krb5.conf" in the Java program and constructing a Kerberos authentication Configuration object.

[0056] Create a UserGroupInformation object.

[0057] Set authentication file and password: Use the information in the authentication file to set the identity credentials, Kerberos user and permission files for the UserGroupInformation object.

[0058] Verify user identity: User authentication is performed by calling the loginUserFromKeytabAndReturnUGI() method of the UserGroupInformation object.

[0059] Returns a UserGroupInformation object that has been successfully verified.

[0060] Example code is:

[0061] system.setProperty("java.security.krb5.conf",krb5Conf);

[0062] UserGroupInformation.setConfiguration(conf);

[0063] UserGroupInformation.loginUserFromKeytabAndReturnUGI(princi pal,keytabFile);

[0064] Step 3: Inject the UserGroupInformation object into the proxy user, and use the proxy user to create a Hive-Connection object; example code is as follows:

[0065] Connection connection=

[0066] UserGroupInformation.createProxyUser("abc",userGroupInformatio n).doAs((PrivilegedAction <connection>)()->{

[0067] return DriverManager.getConnection(jdbcUrl);

[0068] });

[0069] After the above operations, the login and authentication using a Kerberos account are completed, a database connection object is constructed using a proxy user, and Hive SQL statements are executed. The Hive SQL statement and the proxy user will be intercepted by the Ranger permission service for permission verification. This establishes a multi-user permission management system in the Kerberos-hive database.

[0070] Secondly, embodiments of this application also provide a permission management system for Kerberos. This system is used to: store the user's permission management information in the user's Ranger permission service; when a user accesses a Hive database, determine whether the accessed Hive database meets the current user's permissions. If so, allow the current user to use the Kerberos account; otherwise, prohibit the current user from using the Kerberos account.

[0071] In one embodiment, the process of storing the user's permission management information in the user's Ranger permission service of the above system includes: See Figure 1 As shown, the business side creates (add, delete, modify users, etc.) proxy users and synchronizes them to the Ranger permission service; configures the permission management information of the proxy users (specific permissions and policies, such as granting users the right to query, modify, delete, and add users in the specified Hive database), and calls the Ranger permission service to store the permission management information of the proxy users.

[0072] Based on this, when the above system detects a user accessing a Hive database, the process of determining whether the accessed Hive database complies with the current user's permissions includes: configuring Kerberos account information for the proxy user and creating a Hive database connection object through the proxy user; when the proxy user accesses the Hive database, determining the proxy user's permission management information in the Ranger permission service; and determining whether the Hive database to be accessed complies with permissions based on the permission management information.

[0073] Specifically, the aforementioned system includes:

[0074] The proxy user configuration module is used for: creating proxy users and synchronizing them to the Ranger permission service; configuring the proxy user's permission management information and calling the Ranger permission service to store the proxy user's permission management information; and when a proxy user is detected accessing the Hive database, appending the proxy user to the hive-jdbc-url connection path, with the key "hive.server2.proxy.user=" and the value being the proxy user's name (e.g., abc). An example of the completed configuration is shown below:

[0075] jdbc:hive2: / / xxx.com:2181 / ; serviceDiscoveryMode=zooKeeper; zooKeeperNamespace=hiveserver2; auth=KERBEROS; principal=hive / _HOS T@xxx.COM; user.principal=xxx; user.keytab= / etc / user.keytab; hive.server2.proxy.user=abc;

[0076] The Kerberos login environment configuration module is used to: construct a UserGroupInformation object, specifically by setting the environment variable "java.security.krb5.conf" in the Java program and constructing a Kerberos authentication Configuration object.

[0077] Create a UserGroupInformation object.

[0078] Set authentication file and password: Use the information in the authentication file to set the identity credentials, Kerberos user and permission files for the UserGroupInformation object.

[0079] Verify user identity: User authentication is performed by calling the loginUserFromKeytabAndReturnUGI() method of the UserGroupInformation object.

[0080] Returns a UserGroupInformation object that has been successfully verified.

[0081] Example code is:

[0082] system.setProperty("java.security.krb5.conf",krb5Conf);

[0083] UserGroupInformation.setConfiguration(conf);

[0084] UserGroupInformation.loginUserFromKeytabAndReturnUGI(princi pal,keytabFile);

[0085] The database connection module is used to: inject a UserGroupInformation object into a proxy user, and use the proxy user to create a Hive-Connection object; example code is as follows:

[0086] Connection connection=

[0087] UserGroupInformation.createProxyUser("abc",userGroupInformatio n).doAs((PrivilegedAction <connection>)()->{

[0088] return DriverManager.getConnection(jdbcUrl);

[0089] });

[0090] After the above operations, the login and authentication using a Kerberos account are completed, a database connection object is constructed using a proxy user, and Hive SQL statements are executed. The Hive SQL statement and the proxy user will be intercepted by the Ranger permission service for permission verification. This establishes a multi-user permission management system in the Kerberos-hive database.

[0091] Thirdly, embodiments of this application provide a permission management device for Kerberos. The permission management device for Kerberos can be a personal computer (PC), a laptop computer, a server, or other device with data processing capabilities.

[0092] Reference Figure 3 , Figure 3 This is a schematic diagram of the hardware structure of a permission management device for Kerberos involved in an embodiment of this application. In this embodiment, the permission management device for Kerberos may include a processor, a memory, a communication interface, and a communication bus.

[0093] The communication bus can be of any type and is used to interconnect the processor, memory, and communication interface.

[0094] The communication interface includes input / output (I / O) interfaces, physical interfaces, and logical interfaces used for interconnecting devices within the Kerberos access control device, as well as interfaces used for interconnecting the Kerberos access control device with other devices (such as other computing devices or user devices). Physical interfaces can be Ethernet interfaces, fiber optic interfaces, ATM interfaces, etc.; user devices can be displays, keyboards, etc.

[0095] Memory can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), flash memory, optical storage, hard disk, programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), etc.

[0096] The processor can be a general-purpose processor, which can call a permission management program for Kerberos stored in memory and execute the permission management method for Kerberos provided in the embodiments of this application. For example, the general-purpose processor can be a central processing unit (CPU). The method executed when the permission management program for Kerberos is called can be referred to in the various embodiments of the permission management method for Kerberos in this application, and will not be repeated here.

[0097] Those skilled in the art will understand that Figure 3 The hardware structure shown does not constitute a limitation of this application and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0098] Fourthly, embodiments of this application also provide a computer-readable storage medium.

[0099] The computer-readable storage medium of this application stores a permission management program for Kerberos, wherein when the permission management program for Kerberos is executed by a processor, it implements the steps of the permission management method for Kerberos as described above.

[0100] The method implemented when the permission management program for Kerberos is executed can be referred to in the various embodiments of the permission management method for Kerberos in this application, and will not be repeated here.

[0101] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0102] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0103] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus. The terms "first," "second," and "third," etc., are used to distinguish different objects, etc., and do not indicate a sequence, nor do they limit "first," "second," and "third" to different types.

[0104] In the description of the embodiments in this application, terms such as "exemplary," "for example," or "for instance" are used to indicate that they are examples, illustrations, or explanations. Any embodiment or design described as "exemplary," "for example," or "for instance" in the embodiments of this application should not be construed as being better or more advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary," "for example," or "for instance" is intended to present the relevant concepts in a specific manner.

[0105] In the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The "and / or" in the text is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, in the description of the embodiments of this application, "multiple" means two or more.

[0106] In some processes described in the embodiments of this application, multiple operations or steps are included in a specific order. However, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or they may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.

[0107] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device to execute the methods described in the various embodiments of this application.

[0108] The above are merely specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the scope of the claims.< / connection> < / connection>

Claims

1. A permission management method for Kerberos, characterized in that, The method includes the following steps: Store the user's permission management information in the user's Ranger permission service; When a user is detected accessing a Hive database, it is determined whether the accessed Hive database complies with the current user's permissions, specifically including: Concatenate the proxy user in the connection path; In the Java program, set the environment variable "java.security.krb5.conf", construct the Kerberos authentication Configuration object, and create a UserGroupInformation object; Use the information in the authentication file to set the identity credentials, Kerberos user, and permission file for the UserGroupInformation object; User authentication is performed by calling the UserGroupInformation object; Returns a UserGroupInformation object that has been successfully verified; Inject the UserGroupInformation object into the proxy user, and use the proxy user to create a Hive-Connection object; If yes, allow the current user to use the Kerberos account; otherwise, prohibit the current user from using the Kerberos account.

2. The permission management method for Kerberos as described in claim 1, characterized in that: The process of storing the user's permission management information in the user's Ranger permission service includes: the business side creates a proxy user and synchronizes it to the Ranger permission service; configures the proxy user's permission management information; and calls the Ranger permission service to store the proxy user's permission management information.

3. The permission management method for Kerberos as described in claim 2, characterized in that: The process of determining whether the accessed Hive database complies with the current user's permissions when a user accesses the Hive database includes: configuring Kerberos account information for the proxy user and creating a Hive database connection object through the proxy user; determining the proxy user's permission management information in the Ranger permission service when the proxy user accesses the Hive database; and determining whether the Hive database to be accessed complies with the permissions based on the permission management information.

4. A permission management system for Kerberos, characterized in that, This system is used to: store the user's permission management information in the user's Ranger permission service; when a user accesses a Hive database, determine whether the accessed Hive database is within the current user's permissions, and if so, allow the current user to use the Kerberos account; otherwise, prohibit the current user from using the Kerberos account. The system specifically includes: The proxy user configuration module is used for: creating proxy users and synchronizing them to the Ranger permission service; configuring the permission management information of proxy users and calling the Ranger permission service to store the permission management information of proxy users; and appending the proxy user to the connection path when a proxy user is detected accessing the Hive database. The Kerberos login environment configuration module is used to: set the environment variable "java.security.krb5.conf" in Java programs and construct the Kerberos authentication Configuration object; Create a UserGroupInformation object; Use the information in the authentication file to set the identity credentials, Kerberos user, and permission file for the UserGroupInformation object; User authentication is performed by calling the UserGroupInformation object; Returns a UserGroupInformation object that has been successfully verified; The database connection module is used to: inject UserGroupInformation objects into proxy users, and use the proxy users to create Hive-Connection connection objects.

5. The permission management system for Kerberos as described in claim 4, characterized in that: The process of storing a user's permission management information in the Ranger permission service of the system includes: the business side creates a proxy user and synchronizes it to the Ranger permission service; configures the permission management information of the proxy user; and calls the Ranger permission service to store the permission management information of the proxy user.

6. The permission management system for Kerberos as described in claim 5, characterized in that: When the system detects a user accessing a Hive database, the process for determining whether the accessed Hive database complies with the current user's permissions includes: configuring Kerberos account information for the proxy user and creating a Hive database connection object through the proxy user; when the system detects the proxy user accessing the Hive database, determining the proxy user's permission management information in the Ranger permission service; and determining whether the Hive database to be accessed complies with the permissions based on the permission management information.

7. A permission management device for Kerberos, characterized in that, The permission management device for Kerberos includes a processor, a memory, and a permission management program for Kerberos stored in the memory and executable by the processor, wherein when the permission management program for Kerberos is executed by the processor, it implements the steps of the permission management method for Kerberos as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a permission management program for Kerberos, wherein when the permission management program for Kerberos is executed, it implements the steps of the permission management method for Kerberos as described in any one of claims 1 to 3.

Images