Hive 拒绝访问-EMR Presto-基于文件的授权

我在从Presto（AWS EMR）查询时遇到了一个奇怪的问题。我使用的是Presto 0.194，一切正常，升级到0.224后，我无法运行我的查询。我对presto使用LDAP身份验证，并使用authorization.json文件对Hive使用文件基授权。我使用的是旧版本中正常工作的json文件。任何帮助都将不胜感激

错误： 查询20191005_104119_00006_3snge失败：访问被拒绝：视图所有者“用户名”无法创建从中选择的视图

config.properties：

coordinator=true
node-scheduler.include-coordinator=false
discovery.uri=http://IP.ap-southeast-1.compute.internal:8889
http-server.threads.max=500
discovery-server.enabled=true
sink.max-buffer-size=1GB
query.max-memory=30GB
query.max-memory-per-node=6532645258B
query.max-total-memory-per-node=7839174309B
query.max-history=40
query.min-expire-age=30m
http-server.http.port=8889
http-server.log.path=/var/log/presto/http-request.log
http-server.log.max-size=67108864B
http-server.log.max-history=5
log.max-size=268435456B
log.max-history=5
query.execution-policy=phased
optimizer.dictionary-aggregation=true
optimizer.optimize-metadata-queries=true
colocated-joins-enabled=true
http-server.authentication.type=PASSWORD
http-server.https.enabled=true
http-server.https.port=9443
http-server.https.keystore.path=/etc/presto/presto_keystore.jks
http-server.https.keystore.key=passw0rd
node-scheduler.max-splits-per-node=125
optimizer.use-mark-distinct=false 

hive.properties：

hive.metastore-refresh-interval=1m
connector.name=hive-hadoop2
hive.metastore.uri=thrift://ip-10-0-2-141.ap-southeast- 
1.compute.internal:9083
hive.metastore-cache-ttl=20m
hive.config.resources=/etc/hadoop/conf/core- 
site.xml,/etc/hadoop/conf/hdfs-site.xml
hive.non-managed-table-writes-enabled = true
hive.s3-file-system-type = EMRFS
hive.hdfs.authentication.type = NONE
hive.hdfs.impersonation.enabled = true
hive.orc.bloom-filters.enabled=true
hive.recursive-directories=true
hive.s3select-pushdown.enabled=true
hive.security=file
security.config-file=/etc/presto/conf.dist/authorization.json

access-control.name=file
security.config-file=/etc/presto/conf.dist/rules.json

authorization.json：

{
"schemas": [
{
  "user": "prestoSA",
  "owner": true
},
{
  "user": "marketing_jack",
  "owner": true
},
{
  "user": "system-apiquery",
  "owner": true
},
{
  "user": "redash",
  "owner": true
},
{
  "user": "system_.*",
  "schema": "prestosync_.*",
  "owner": true
},
{
  "user": "system_.*",
  "schema": "views_.*",
  "owner": true
},
{
  "user": "system_.*",
  "schema": "raw_.*",
  "owner": true
}
],
"tables": [
{
  "user": "prestoSA",
  "privileges": [
    "SELECT",
    "INSERT",
    "DELETE",
    "OWNERSHIP"
  ]
},
{
  "user": "redash",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "raw_.*",
  "user": "system_.*",
  "privileges": [
    "SELECT",
    "INSERT",
    "DELETE",
    "OWNERSHIP"
  ]
},
{
  "schema": "production_.*",
  "user": "system_.*",
  "privileges": [
    "SELECT",
    "INSERT",
    "DELETE",
    "OWNERSHIP"
  ]
},
{
  "schema": "prestosync_.*",
  "user": "system_.*",
  "privileges": [
    "SELECT",
    "INSERT",
    "DELETE",
    "OWNERSHIP"
  ]
},
{
  "schema": "views_.*",
  "user": "system_.*",
  "privileges": [
    "SELECT",
    "INSERT",
    "DELETE",
    "OWNERSHIP"
  ]
},
{
  "schema": ".*dev",
  "user": "developer_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "raw_rin",
  "user": "developer_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": ".*prod",
  "user": "developer_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_development_.*",
  "user": "marketing_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_prod",
  "user": "marketing_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_dev",
  "user": "sales_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_prod",
  "user": "sales_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "emr59_prod",
  "user": "marketing_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_dev",
  "user": "management_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_prod",
  "user": "management_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_dev",
  "user": "management_.*",
  "privileges": [
    "SELECT"
  ]
},
{
  "schema": "views_prod",
  "user": "management_.*",
  "privileges": [
    "SELECT"
  ]
}
]
}

acceess-control.properties：

hive.metastore-refresh-interval=1m
connector.name=hive-hadoop2
hive.metastore.uri=thrift://ip-10-0-2-141.ap-southeast- 
1.compute.internal:9083
hive.metastore-cache-ttl=20m
hive.config.resources=/etc/hadoop/conf/core- 
site.xml,/etc/hadoop/conf/hdfs-site.xml
hive.non-managed-table-writes-enabled = true
hive.s3-file-system-type = EMRFS
hive.hdfs.authentication.type = NONE
hive.hdfs.impersonation.enabled = true
hive.orc.bloom-filters.enabled=true
hive.recursive-directories=true
hive.s3select-pushdown.enabled=true
hive.security=file
security.config-file=/etc/presto/conf.dist/authorization.json

access-control.name=file
security.config-file=/etc/presto/conf.dist/rules.json

rules.json：

{
"catalogs": [
 {
  "user": "system_.*",
  "catalog": "(mysql|system)",
  "allow": true
},
{
  "user": "prestoSA",
  "catalog": "(mysql|system)",
  "allow": true
},
{
  "user": "redash",
  "catalog": "(mysql|system)",
  "allow": true
},
{
  "user": "developer_.*",
  "catalog": "(mysql|hive)",
  "allow": true
},
{
  "catalog": "hive",
  "allow": true
},
{
  "catalog": "system",
  "allow": false
}
]
}

错误：查询20191005_104119_00006_3snge失败：访问被拒绝：视图所有者“用户名”无法创建从中选择的视图

这意味着，

username

对特定表没有

GRANT\u SELECT

权限

影响您的特定更改出现在0.199版本中： 这是一个错误修复（创建视图应该需要不同的权限），因此故意（尽管不方便）更改没有保持向后兼容性

顺便说一句

---

对于不太可能对SO社区有益的一次性疑难解答式问题，我建议使用

#疑难解答
频道
您没有上传任何authorization.json文件，config file just error，我能为您提供什么帮助？@Lamanus感谢您的回复。我添加了配置。感谢Piotr的回复！1.看来我需要一份加入Slack工作区的邀请。(ahmokhtari@gmail.com) 2. 正如我在问题中提到的，我们对配置单元使用文件授权方法，所有权限都可以在authorization.json文件中使用。旧版本中使用的文件内容相同。@ahmokhtari re 1:有注册链接，但我已向您发送了个人邀请。Re 2：我添加了对提交的引用，它改变了要求您更新配置的行为。