Apache Sentry

Apache Sentry improves the overall security of data and metadata stored on an Apache Hadoop database.

This allows developers to secure their databases against unauthorized access and use an alternative security system to regular HTTP safety measures.

Sentry is not a full-blown Hadoop firewall, but it surely comes close to it.

Out of all the Hadoop stack, only Apache Hive is currently supported.

What is new in this release:

• Create a diagnostics tool for configuration validation
• Implement a DB backed policy store
• Give bindings the ability to access the group mappings
• Support filter pushdown in DB Store client to reduce data transfer from DB Store service
• Hive bindings should enable MR level ACLs for session user
• Implement createShowRolesTask() in SentryHiveAuthorizationTaskFactoryImpl
• Added Sentry service APIs to query roles and privileges
• Create tool that will convert policy file into into DB store
• SHOW GRANT ROLE xxx ON [SERVER, DATABASE, TABLE, URI] xxx
• Support SHOW CURRENT ROLES

What is new in version 1.5.0:

• Create a diagnostics tool for configuration validation
• Implement a DB backed policy store
• Give bindings the ability to access the group mappings
• Support filter pushdown in DB Store client to reduce data transfer from DB Store service
• Hive bindings should enable MR level ACLs for session user
• Implement createShowRolesTask() in SentryHiveAuthorizationTaskFactoryImpl
• Added Sentry service APIs to query roles and privileges
• Create tool that will convert policy file into into DB store
• SHOW GRANT ROLE xxx ON [SERVER, DATABASE, TABLE, URI] xxx
• Support SHOW CURRENT ROLES

What is new in version 1.4.0:

• Create a diagnostics tool for configuration validation
• Implement a DB backed policy store
• Give bindings the ability to access the group mappings
• Support filter pushdown in DB Store client to reduce data transfer from DB Store service
• Hive bindings should enable MR level ACLs for session user
• Implement createShowRolesTask() in SentryHiveAuthorizationTaskFactoryImpl
• Added Sentry service APIs to query roles and privileges
• Create tool that will convert policy file into into DB store
• SHOW GRANT ROLE xxx ON [SERVER, DATABASE, TABLE, URI] xxx
• Support SHOW CURRENT ROLES

What is new in version 1.2.0:

• Normalized the usernames used in the end to end tests.
• ResourceAuthzProvider should ensure the subject name is non-null before doing the group lookup.
• Access hard codes hive authentication method none.
• Added Maven profile for compiling access with upstream Apache Hadoop/Hive.
• Restrict the URI access granted from a per-database policy file.

Limitations:

• The project is still under development in the Apache Incubator repository and might change drastically from version to version.