drill-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bridg...@apache.org
Subject [05/11] drill git commit: bridget's doc
Date Wed, 06 May 2015 22:46:29 GMT
bridget's doc


Project: http://git-wip-us.apache.org/repos/asf/drill/repo
Commit: http://git-wip-us.apache.org/repos/asf/drill/commit/26b0e529
Tree: http://git-wip-us.apache.org/repos/asf/drill/tree/26b0e529
Diff: http://git-wip-us.apache.org/repos/asf/drill/diff/26b0e529

Branch: refs/heads/gh-pages
Commit: 26b0e529e5ba49da3248c466b514da506f93aed0
Parents: caac1e2
Author: Kristine Hahn <khahn@maprtech.com>
Authored: Tue May 5 18:45:45 2015 -0700
Committer: Kristine Hahn <khahn@maprtech.com>
Committed: Tue May 5 18:45:45 2015 -0700

----------------------------------------------------------------------
 _data/docs.json                                 | 137 +++++++++--------
 _docs/architecture/040-bridget-test.md          | 133 ----------------
 .../012-configuring-a-multitenant-cluster.md    |   5 -
 .../012-configuring-user-impersonation.md       | 150 +++++++++++++++++++
 ...guring-a-multitenant-cluster-introduction.md |  22 ---
 .../013-configuring-a-multitenant-cluster.md    |   5 +
 ...guring-a-multitenant-cluster-introduction.md |  22 +++
 7 files changed, 254 insertions(+), 220 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/drill/blob/26b0e529/_data/docs.json
----------------------------------------------------------------------
diff --git a/_data/docs.json b/_data/docs.json
index 95424c3..c4a02f2 100644
--- a/_data/docs.json
+++ b/_data/docs.json
@@ -860,8 +860,8 @@
                 }
             ], 
             "children": [], 
-            "next_title": "Configuring a Multitenant Cluster", 
-            "next_url": "/docs/configuring-a-multitenant-cluster/", 
+            "next_title": "Configuring User Impersonation", 
+            "next_url": "/docs/configuring-user-impersonation/", 
             "parent": "Manage Drill", 
             "previous_title": "Manage Drill Introduction", 
             "previous_url": "/docs/manage-drill-introduction/", 
@@ -911,6 +911,23 @@
             "title": "Configuring Resources for a Shared Drillbit", 
             "url": "/docs/configuring-resources-for-a-shared-drillbit/"
         }, 
+        "Configuring User Impersonation": {
+            "breadcrumbs": [
+                {
+                    "title": "Manage Drill", 
+                    "url": "/docs/manage-drill/"
+                }
+            ], 
+            "children": [], 
+            "next_title": "Configuring a Multitenant Cluster", 
+            "next_url": "/docs/configuring-a-multitenant-cluster/", 
+            "parent": "Manage Drill", 
+            "previous_title": "Configuring Drill in a Dedicated Cluster", 
+            "previous_url": "/docs/configuring-drill-in-a-dedicated-cluster/", 
+            "relative_path": "_docs/manage-drill/012-configuring-user-impersonation.md",

+            "title": "Configuring User Impersonation", 
+            "url": "/docs/configuring-user-impersonation/"
+        }, 
         "Configuring a Multitenant Cluster": {
             "breadcrumbs": [
                 {
@@ -936,7 +953,7 @@
                     "parent": "Configuring a Multitenant Cluster", 
                     "previous_title": "Configuring a Multitenant Cluster", 
                     "previous_url": "/docs/configuring-a-multitenant-cluster/", 
-                    "relative_path": "_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md",

+                    "relative_path": "_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md",

                     "title": "Configuring a Multitenant Cluster Introduction", 
                     "url": "/docs/configuring-a-multitenant-cluster-introduction/"
                 }, 
@@ -986,9 +1003,9 @@
             "next_title": "Configuring a Multitenant Cluster Introduction", 
             "next_url": "/docs/configuring-a-multitenant-cluster-introduction/", 
             "parent": "Manage Drill", 
-            "previous_title": "Configuring Drill in a Dedicated Cluster", 
-            "previous_url": "/docs/configuring-drill-in-a-dedicated-cluster/", 
-            "relative_path": "_docs/manage-drill/012-configuring-a-multitenant-cluster.md",

+            "previous_title": "Configuring User Impersonation", 
+            "previous_url": "/docs/configuring-user-impersonation/", 
+            "relative_path": "_docs/manage-drill/013-configuring-a-multitenant-cluster.md",

             "title": "Configuring a Multitenant Cluster", 
             "url": "/docs/configuring-a-multitenant-cluster/"
         }, 
@@ -1009,7 +1026,7 @@
             "parent": "Configuring a Multitenant Cluster", 
             "previous_title": "Configuring a Multitenant Cluster", 
             "previous_url": "/docs/configuring-a-multitenant-cluster/", 
-            "relative_path": "_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md",

+            "relative_path": "_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md",

             "title": "Configuring a Multitenant Cluster Introduction", 
             "url": "/docs/configuring-a-multitenant-cluster-introduction/"
         }, 
@@ -3649,8 +3666,8 @@
                         }
                     ], 
                     "children": [], 
-                    "next_title": "Configuring a Multitenant Cluster", 
-                    "next_url": "/docs/configuring-a-multitenant-cluster/", 
+                    "next_title": "Configuring User Impersonation", 
+                    "next_url": "/docs/configuring-user-impersonation/", 
                     "parent": "Manage Drill", 
                     "previous_title": "Manage Drill Introduction", 
                     "previous_url": "/docs/manage-drill-introduction/", 
@@ -3665,6 +3682,23 @@
                             "url": "/docs/manage-drill/"
                         }
                     ], 
+                    "children": [], 
+                    "next_title": "Configuring a Multitenant Cluster", 
+                    "next_url": "/docs/configuring-a-multitenant-cluster/", 
+                    "parent": "Manage Drill", 
+                    "previous_title": "Configuring Drill in a Dedicated Cluster", 
+                    "previous_url": "/docs/configuring-drill-in-a-dedicated-cluster/", 
+                    "relative_path": "_docs/manage-drill/012-configuring-user-impersonation.md",

+                    "title": "Configuring User Impersonation", 
+                    "url": "/docs/configuring-user-impersonation/"
+                }, 
+                {
+                    "breadcrumbs": [
+                        {
+                            "title": "Manage Drill", 
+                            "url": "/docs/manage-drill/"
+                        }
+                    ], 
                     "children": [
                         {
                             "breadcrumbs": [
@@ -3683,7 +3717,7 @@
                             "parent": "Configuring a Multitenant Cluster", 
                             "previous_title": "Configuring a Multitenant Cluster", 
                             "previous_url": "/docs/configuring-a-multitenant-cluster/", 
-                            "relative_path": "_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md",

+                            "relative_path": "_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md",

                             "title": "Configuring a Multitenant Cluster Introduction", 
                             "url": "/docs/configuring-a-multitenant-cluster-introduction/"
                         }, 
@@ -3733,9 +3767,9 @@
                     "next_title": "Configuring a Multitenant Cluster Introduction", 
                     "next_url": "/docs/configuring-a-multitenant-cluster-introduction/",

                     "parent": "Manage Drill", 
-                    "previous_title": "Configuring Drill in a Dedicated Cluster", 
-                    "previous_url": "/docs/configuring-drill-in-a-dedicated-cluster/", 
-                    "relative_path": "_docs/manage-drill/012-configuring-a-multitenant-cluster.md",

+                    "previous_title": "Configuring User Impersonation", 
+                    "previous_url": "/docs/configuring-user-impersonation/", 
+                    "relative_path": "_docs/manage-drill/013-configuring-a-multitenant-cluster.md",

                     "title": "Configuring a Multitenant Cluster", 
                     "url": "/docs/configuring-a-multitenant-cluster/"
                 }, 
@@ -4544,31 +4578,14 @@
                         }
                     ], 
                     "children": [], 
-                    "next_title": "Using Apache Drill with Tibco Spotfire Desktop", 
-                    "next_url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/",

+                    "next_title": "Query Data", 
+                    "next_url": "/docs/query-data/", 
                     "parent": "ODBC/JDBC Interfaces", 
                     "previous_title": "Using MicroStrategy Analytics with Drill", 
                     "previous_url": "/docs/using-microstrategy-analytics-with-drill/", 
                     "relative_path": "_docs/odbc-jdbc-interfaces/060-using-apache-drill-with-tibco-spotfire-desktop.md",

                     "title": "Using Apache Drill with Tibco Spotfire Desktop", 
                     "url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/"
-                }, 
-                {
-                    "breadcrumbs": [
-                        {
-                            "title": "ODBC/JDBC Interfaces", 
-                            "url": "/docs/odbc-jdbc-interfaces/"
-                        }
-                    ], 
-                    "children": [], 
-                    "next_title": "Query Data", 
-                    "next_url": "/docs/query-data/", 
-                    "parent": "ODBC/JDBC Interfaces", 
-                    "previous_title": "Using Apache Drill with Tibco Spotfire Desktop", 
-                    "previous_url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/",

-                    "relative_path": "_docs/odbc-jdbc-interfaces/060-using-spotfire.md",

-                    "title": "Using Apache Drill with Tibco Spotfire Desktop", 
-                    "url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/"
                 }
             ], 
             "next_title": "Interfaces Introduction", 
@@ -8121,9 +8138,9 @@
             "next_title": "Query Data", 
             "next_url": "/docs/query-data/", 
             "parent": "ODBC/JDBC Interfaces", 
-            "previous_title": "Using Apache Drill with Tibco Spotfire Desktop", 
-            "previous_url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/", 
-            "relative_path": "_docs/odbc-jdbc-interfaces/060-using-spotfire.md", 
+            "previous_title": "Using MicroStrategy Analytics with Drill", 
+            "previous_url": "/docs/using-microstrategy-analytics-with-drill/", 
+            "relative_path": "_docs/odbc-jdbc-interfaces/060-using-apache-drill-with-tibco-spotfire-desktop.md",

             "title": "Using Apache Drill with Tibco Spotfire Desktop", 
             "url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/"
         }, 
@@ -9875,31 +9892,14 @@
                         }
                     ], 
                     "children": [], 
-                    "next_title": "Using Apache Drill with Tibco Spotfire Desktop", 
-                    "next_url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/",

+                    "next_title": "Query Data", 
+                    "next_url": "/docs/query-data/", 
                     "parent": "ODBC/JDBC Interfaces", 
                     "previous_title": "Using MicroStrategy Analytics with Drill", 
                     "previous_url": "/docs/using-microstrategy-analytics-with-drill/", 
                     "relative_path": "_docs/odbc-jdbc-interfaces/060-using-apache-drill-with-tibco-spotfire-desktop.md",

                     "title": "Using Apache Drill with Tibco Spotfire Desktop", 
                     "url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/"
-                }, 
-                {
-                    "breadcrumbs": [
-                        {
-                            "title": "ODBC/JDBC Interfaces", 
-                            "url": "/docs/odbc-jdbc-interfaces/"
-                        }
-                    ], 
-                    "children": [], 
-                    "next_title": "Query Data", 
-                    "next_url": "/docs/query-data/", 
-                    "parent": "ODBC/JDBC Interfaces", 
-                    "previous_title": "Using Apache Drill with Tibco Spotfire Desktop", 
-                    "previous_url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/",

-                    "relative_path": "_docs/odbc-jdbc-interfaces/060-using-spotfire.md",

-                    "title": "Using Apache Drill with Tibco Spotfire Desktop", 
-                    "url": "/docs/using-apache-drill-with-tibco-spotfire-desktop/"
                 }
             ], 
             "next_title": "Interfaces Introduction", 
@@ -11310,8 +11310,8 @@
                         }
                     ], 
                     "children": [], 
-                    "next_title": "Configuring a Multitenant Cluster", 
-                    "next_url": "/docs/configuring-a-multitenant-cluster/", 
+                    "next_title": "Configuring User Impersonation", 
+                    "next_url": "/docs/configuring-user-impersonation/", 
                     "parent": "Manage Drill", 
                     "previous_title": "Manage Drill Introduction", 
                     "previous_url": "/docs/manage-drill-introduction/", 
@@ -11326,6 +11326,23 @@
                             "url": "/docs/manage-drill/"
                         }
                     ], 
+                    "children": [], 
+                    "next_title": "Configuring a Multitenant Cluster", 
+                    "next_url": "/docs/configuring-a-multitenant-cluster/", 
+                    "parent": "Manage Drill", 
+                    "previous_title": "Configuring Drill in a Dedicated Cluster", 
+                    "previous_url": "/docs/configuring-drill-in-a-dedicated-cluster/", 
+                    "relative_path": "_docs/manage-drill/012-configuring-user-impersonation.md",

+                    "title": "Configuring User Impersonation", 
+                    "url": "/docs/configuring-user-impersonation/"
+                }, 
+                {
+                    "breadcrumbs": [
+                        {
+                            "title": "Manage Drill", 
+                            "url": "/docs/manage-drill/"
+                        }
+                    ], 
                     "children": [
                         {
                             "breadcrumbs": [
@@ -11344,7 +11361,7 @@
                             "parent": "Configuring a Multitenant Cluster", 
                             "previous_title": "Configuring a Multitenant Cluster", 
                             "previous_url": "/docs/configuring-a-multitenant-cluster/", 
-                            "relative_path": "_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md",

+                            "relative_path": "_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md",

                             "title": "Configuring a Multitenant Cluster Introduction", 
                             "url": "/docs/configuring-a-multitenant-cluster-introduction/"
                         }, 
@@ -11394,9 +11411,9 @@
                     "next_title": "Configuring a Multitenant Cluster Introduction", 
                     "next_url": "/docs/configuring-a-multitenant-cluster-introduction/",

                     "parent": "Manage Drill", 
-                    "previous_title": "Configuring Drill in a Dedicated Cluster", 
-                    "previous_url": "/docs/configuring-drill-in-a-dedicated-cluster/", 
-                    "relative_path": "_docs/manage-drill/012-configuring-a-multitenant-cluster.md",

+                    "previous_title": "Configuring User Impersonation", 
+                    "previous_url": "/docs/configuring-user-impersonation/", 
+                    "relative_path": "_docs/manage-drill/013-configuring-a-multitenant-cluster.md",

                     "title": "Configuring a Multitenant Cluster", 
                     "url": "/docs/configuring-a-multitenant-cluster/"
                 }, 

http://git-wip-us.apache.org/repos/asf/drill/blob/26b0e529/_docs/architecture/040-bridget-test.md
----------------------------------------------------------------------
diff --git a/_docs/architecture/040-bridget-test.md b/_docs/architecture/040-bridget-test.md
deleted file mode 100644
index f66ea73..0000000
--- a/_docs/architecture/040-bridget-test.md
+++ /dev/null
@@ -1,133 +0,0 @@
----
-title: "User Impersonation"
-parent: "Architecture"
----
-Impersonation allows a service to act on behalf of a client while performing the action requested
by the client. By default, user impersonation is disabled in Drill. You can configure user
impersonation in the drill-override.conf file.
- 
-When you enable impersonation, Drill executes client requests as the user logged in to the
client. Drill passes the user credentials to the file system, and the file system checks to
see if the user has permission to access the data. When you enable authentication, Drill uses
the pluggable authentication module (PAM) to authenticate a user’s identity before the user
can access the Drillbit process. See User Authentication.
- 
-If impersonation is not configured, Drill executes all of the client requests against the
file system as the user that started the Drillbit service on the node. This is typically a
privileged user. The file system verifies that the system user has permission to access the
data.
-
-
-## Example
-When impersonation is disabled and user Bob issues a query through the SQLLine client, SQLLine
passes the query to the connecting Drillbit. The Drillbit executes the query as the system
user that started the Drill process on the node. For the purpose of this example, we will
assume that the system user has full access to the file system. Drill executes the query and
returns the results back to the client.
-![](http://i.imgur.com/4XxQK2I.png)
-
-When impersonation is enabled and user Bob issues a query through the SQLLine client, the
Drillbit executes the query against the file system as Bob. The file system checks to see
if Bob has permission to access the data. If so, Drill returns the query results to the client.
If Bob does not have permission, Drill returns an error.
-![](http://i.imgur.com/oigWqVg.png)
-
-## Impersonation Support
-The following table lists the clients, storage plugins, and types of queries that you can
use with impersonation in Drill:
-
-| Type     | Supported     | Not Supported     |
-|-----------------    |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   |-----------------------    |
-| Clients     | SQLLine ODBC JDBC     | Drill Web UI REST API     |
-| Storage Plugins     | File System     | Hive HBase     |
-| Queries     | When you enable impersonation, the setting applies to queries on data and
metadata. For example, if you issue the SHOW SCHEMAS command, Drill impersonates the user
logged into the client to access the requested metadata. If you issue a SELECT  query on a
workspace, Drill impersonates the user logged in to the client to access the requested data.
Drill applies impersonation to queries issued using the following commands: SHOW SCHEMAS SHOW
DATABASES SHOW TABLES CTAS SELECT CREATE VIEW DROP VIEW SHOW FILES  To successfully run the
CTAS and CREATE VIEW commands, a user must have write permissions on the directory where the
table or view will exist. Running these commands creates artifacts on the file system.   
 |      |
-
-## Impersonation and Views
-You can use views with impersonation to provide granular access to data and protect sensitive
information. When you create a view, Drill stores the view definition in a file and suffixes
the file with .drill.view. For example, if you create a view named myview, Drill creates a
view file named myview.drill.view and saves it in the current workspace or the workspace specified,
such as dfs.views.myview. See CREATE VIEW Command.
-
-You can create a view and grant read permissions on the view to give other users access to
the data that the view references. When a user queries the view, Drill impersonates the view
owner to access the underlying data. A user with read access to a view can create new views
from the originating view to further restrict access on data.
-
-### View Permissions
-A user must have write permission on a directory or workspace to create a view, as well as
read access on the table(s) and/or view(s) that the view references. When a user creates a
view, permission on the view is set to owner by default. Users can query an existing view
or create new views from the view if they have read permissions on the view file and the directory
or workspace where the view file is stored. 
-
-When users query a view, Drill accesses the underlying data as the user that created the
view. If a user does not have permission to access a view, the query fails and Drill returns
an error. Only the view owner or a superuser can modify view permissions to change them from
owner to group or world. 
- 
-The view owner or a superuser can modify permissions on the view file directly or they can
set view permissions at the system or session level prior to creating any views. Any user
that alters view permissions must have write access on the directory or workspace in which
they are working. See Modifying Permissions on a View File and Modifying SYSTEM|SESSION Level
View Permissions. 
-
-####Modifying Permissions on a View File
-Only a view owner or a super user can modify permissions on a view file to change them from
owner to group or world readable. Before you grant permission to users to access a view, verify
that they have access to the directory or workspace in which the view file is stored.
-
-Use the `chmod` and `chown` commands with the appropriate octal code to change permissions
on a view file:
-
-
-    hadoop fs –chmod <octal code> <file_name>
-    hadoop fs –chown <user>:<group> <file_name>
-Example: `hadoop fs –chmod 750 employees.drill.view`
-
-####Modifying SYSTEM|SESSION Level View Permissions
-Use the `ALTER SESSION|SYSTEM` command with the `new_view_default_permissions` parameter
and the appropriate octal code to set view permissions at the system or session level prior
to creating a view.
- 
-    ALTER SESSION SET `new_view_default_permissions` = '<octal_code>';
-    ALTER SYSTEM SET `new_view_default_permissions` = '<octal_code>';
- 
-Example: ``ALTER SESSION SET `new_view_default_permissions` = '777';``
- 
-After you set this parameter, Drill applies the same permissions on each view created during
the session or across all sessions if set at the system level.
-
-## Chained Impersonation
-You can configure Drill to allow chained impersonation on views when you enable impersonation
in the `drill-override.conf` file. Chained impersonation controls the number of identity transitions
that Drill can make when a user queries a view. Each identity transition is equal to one hop.
- 
-You can set the maximum number of hops on views to limit the number of times that Drill can
impersonate a different user when a user queries a view. The default maximum number of hops
is set at 3. When the maximum number of hops is set to 0, Drill does not allow impersonation
chaining, and a user can only read data for which they have direct permission to access. You
may set chain length to 0 to protect highly sensitive data. 
- 
-The following example depicts a scenario where the maximum hop number is set to 3, and Drill
must impersonate three users to access data when Chad queries a view that Jane created:
-
-![](http://i.imgur.com/wwpStcs.png)
-
-In the previous example, Joe created a view V3 from views that user Frank created. In the
following example, Joe created view V3 by joining a view that Frank created with a view that
Bob created, thus increasing the number of identity transitions that Drill makes from 3 to
4, which exceeds the maximum hop setting of 3.
- 
-In this scenario, when Chad queries Jane’s view Drill returns an error stating that the
query cannot complete because the number of hops required to access the data exceeds the maximum
hop setting of 3 that is configured.
-
-![](http://i.imgur.com/xO2yIDN.png)
-
-If users encounter this error, you can increase the maximum hop setting to accommodate users
running queries on views. When configuring the maximum number of hops that Drill can make,
consider that joined views increase the number of identity transitions required for Drill
to access the underlying data.
-
-#### Configuring Impersonation and Chaining
-Chaining is a system-wide setting that applies to all views. Currently, Drill does not provide
an option to  allow different chain lengths for different views.
-
-Complete the following steps on each Drillbit node to enable user impersonation, and set
the maximum number of chained user hops that Drill allows:
-
-1. Navigate to `<drill_installation_directory>/conf/` and edit `drill-override.conf`.
-2. Under `drill.exe`, add the following:
-
-       drill.exec.impersonation: {
-             enabled: true,
-              max_chained_user_hops: 3
-       }
-
-3. Verify that enabled is set to `‘true’`.
-4. Set the maximum number of chained user hops that you want Drill to allow.
-5. (MapR cluster only) Add one of the following lines to the `drill-env.sh` file:
-   * If the underlying file system is not secure, add the following line:
-   ` export MAPR_IMPERSONATION_ENABLED=true`
-   * If the underlying file system has MapR security enabled, add the following line:
-    `export MAPR_TICKETFILE_LOCATION=/opt/mapr/conf/mapruserticket`
-6. Restart the Drillbit process on each Drill node.
-   * In a MapR cluster, run the following command:
-    ` maprcli node services -name drill-bits -action restart -nodes `<hostname> -f``
-   * In a non-MapR environment, run the following command:
-     <DRILLINSTALL_HOME>/bin/drillbit.sh restart
-
-
-## Impersonation and Chaining Example
-Frank is a senior HR manager at a company. Frank has access to all of the employee data because
he is a member of the hr group. Frank created a table named “employees” in his home directory
to store the employee data he uses. Only Frank has access to this table.
- 
-drwx------      frank:hr     /user/frank/employees
- 
-Each record in the employees table consists of the following information:
-emp_id, emp_name, emp_ssn, emp_salary, emp_addr, emp_phone, emp_mgr
- 
-Frank needs to share a subset of this information with Joe who is an HR manager reporting
to Frank. To share the employee data, Frank creates a view called emp_mgr_view that accesses
a subset of the data. The emp_mgr_view filters out sensitive employee information, such as
the employee social security numbers, and only shows data for the employees that report directly
to Joe or the manager running the query on the view. Frank and Joe both belong to the mgr
group. Managers have read permission on Frank’s directory.
- 
-rwxr-----     frank:mgr   /user/frank/emp_mgr_view.drill.view
- 
-The emp_mgr_view.drill.view file contains the following view definition:
-(view definition: SELECT emp_id, emp_name, emp_salary, emp_addr, emp_phone FROM `/user/frank/employee`
WHERE emp_mgr = user())
- 
-When Joe issues SELECT * FROM emp_mgr_view, Drill impersonates Frank when accessing the employee
data, and the query returns the data that Joe has permission to see based on the view definition.
The query results do not include any sensitive data because the view protects that information.
If Joe tries to query the employees table directly, Drill returns an error or null values.
- 
-Because Joe has read permissions on the emp_mgr_view, he can create new views from it to
give other users access to the employee data even though he does not own the employees table
and cannot access the employees table directly.
- 
-Joe needs to share employee contact data with his direct reports, so he creates a special
view called emp_team_view to share the employee contact information with his team. Joe creates
the view and writes it to his home directory. Joe and his reports belong to a group named
joeteam. The joeteam group has read permissions on Joe’s home directory so they can query
the view and create new views from it.
- 
-rwxr-----     joe:joeteam   /user/joe/emp_team_view.drill.view
- 
-The emp_team_view.drill.view file contains the following view definition:
- 
-(view definition: SELECT emp_id, emp_name, emp_phone FROM `/user/frank/emp_mgr_view.drill`);
- 
-When anyone on Joe’s team issues SELECT * FROM emp_team_view, Drill impersonates Joe to
access the emp_team_view and then impersonates Frank to access the emp_mgr_view and the employee
data. Drill returns the data that Joe’s team has can see based on the view definition. If
anyone on Joe’s team tries to query the emp_mgr_view or employees table directly, Drill
returns an error or null values.
- 
-Because Joe’s team has read permissions on the emp_team_view, they can create new views
from it and write the views to any directory for which they have write access. Creating views
can continue until Drill reaches the maximum number of impersonation hops.
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/drill/blob/26b0e529/_docs/manage-drill/012-configuring-a-multitenant-cluster.md
----------------------------------------------------------------------
diff --git a/_docs/manage-drill/012-configuring-a-multitenant-cluster.md b/_docs/manage-drill/012-configuring-a-multitenant-cluster.md
deleted file mode 100644
index fe72675..0000000
--- a/_docs/manage-drill/012-configuring-a-multitenant-cluster.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-title: "Configuring a Multitenant Cluster"
-parent: "Manage Drill"
----
-

http://git-wip-us.apache.org/repos/asf/drill/blob/26b0e529/_docs/manage-drill/012-configuring-user-impersonation.md
----------------------------------------------------------------------
diff --git a/_docs/manage-drill/012-configuring-user-impersonation.md b/_docs/manage-drill/012-configuring-user-impersonation.md
new file mode 100644
index 0000000..7f22d9d
--- /dev/null
+++ b/_docs/manage-drill/012-configuring-user-impersonation.md
@@ -0,0 +1,150 @@
+---
+title: "Configuring User Impersonation"
+parent: "Manage Drill"
+---
+Impersonation allows a service to act on behalf of a client while performing the action requested
by the client. By default, user impersonation is disabled in Drill. You can configure user
impersonation in the drill-override.conf file.
+ 
+When you enable impersonation, Drill executes client requests as the user logged in to the
client. Drill passes the user credentials to the file system, and the file system checks to
see if the user has permission to access the data. When you enable authentication, Drill uses
the pluggable authentication module (PAM) to authenticate a user’s identity before the user
can access the Drillbit process. See User Authentication.
+ 
+If impersonation is not configured, Drill executes all of the client requests against the
file system as the user that started the Drillbit service on the node. This is typically a
privileged user. The file system verifies that the system user has permission to access the
data.
+
+
+## Example
+When impersonation is disabled and user Bob issues a query through the SQLLine client, SQLLine
passes the query to the connecting Drillbit. The Drillbit executes the query as the system
user that started the Drill process on the node. For the purpose of this example, we will
assume that the system user has full access to the file system. Drill executes the query and
returns the results back to the client.
+![](http://i.imgur.com/4XxQK2I.png)
+
+When impersonation is enabled and user Bob issues a query through the SQLLine client, the
Drillbit executes the query against the file system as Bob. The file system checks to see
if Bob has permission to access the data. If so, Drill returns the query results to the client.
If Bob does not have permission, Drill returns an error.
+![](http://i.imgur.com/oigWqVg.png)
+
+## Impersonation Support
+The following table lists the clients, storage plugins, and types of queries that you can
use with impersonation in Drill:
+
+<table>
+  <tr>
+    <th>Type</th>
+    <th>Supported</th>
+    <th>Not Supported</th>
+  </tr>
+  <tr>
+    <td>Clients</td>
+    <td>SQLLine ODBC JDBC</td>
+    <td>Drill Web UI REST API</td>
+  </tr>
+  <tr>
+    <td>Storage Plugins</td>
+    <td>File System</td>
+    <td>Hive HBase</td>
+  </tr>
+  <tr>
+    <td>Queries</td>
+    <td>When you enable impersonation, the setting applies to queries on data and metadata.
For example, if you issue the SHOW SCHEMAS command, Drill impersonates the user logged into
the client to access the requested metadata. If you issue a SELECT query on a workspace, Drill
impersonates the user logged in to the client to access the requested data. Drill applies
impersonation to queries issued using the following commands: <br>SHOW SCHEMAS <br>SHOW
DATABASES<br> SHOW TABLES<br> CTAS<br> SELECT<br> CREATE VIEW<br>
DROP VIEW<br> SHOW FILES<br> To successfully run the CTAS and CREATE VIEW commands,
a user must have write permissions on the directory where the table or view will exist. Running
these commands creates artifacts on the file system.</td>
+    <td></td>
+  </tr>
+</table>
+
+## Impersonation and Views
+You can use views with impersonation to provide granular access to data and protect sensitive
information. When you create a view, Drill stores the view definition in a file and suffixes
the file with .drill.view. For example, if you create a view named myview, Drill creates a
view file named myview.drill.view and saves it in the current workspace or the workspace specified,
such as dfs.views.myview. See [CREATE VIEW]({{site.baseurl}}/docs/create-view-command/) Command.
+
+You can create a view and grant read permissions on the view to give other users access to
the data that the view references. When a user queries the view, Drill impersonates the view
owner to access the underlying data. A user with read access to a view can create new views
from the originating view to further restrict access on data.
+
+### View Permissions
+A user must have write permission on a directory or workspace to create a view, as well as
read access on the table(s) and/or view(s) that the view references. When a user creates a
view, permission on the view is set to owner by default. Users can query an existing view
or create new views from the view if they have read permissions on the view file and the directory
or workspace where the view file is stored. 
+
+When users query a view, Drill accesses the underlying data as the user that created the
view. If a user does not have permission to access a view, the query fails and Drill returns
an error. Only the view owner or a superuser can modify view permissions to change them from
owner to group or world. 
+ 
+The view owner or a superuser can modify permissions on the view file directly or they can
set view permissions at the system or session level prior to creating any views. Any user
that alters view permissions must have write access on the directory or workspace in which
they are working. See Modifying Permissions on a View File and Modifying SYSTEM|SESSION Level
View Permissions. 
+
+#### Modifying Permissions on a View File
+Only a view owner or a super user can modify permissions on a view file to change them from
owner to group or world readable. Before you grant permission to users to access a view, verify
that they have access to the directory or workspace in which the view file is stored.
+
+Use the `chmod` and `chown` commands with the appropriate octal code to change permissions
on a view file:
+
+
+    hadoop fs –chmod <octal code> <file_name>
+    hadoop fs –chown <user>:<group> <file_name>
+Example: `hadoop fs –chmod 750 employees.drill.view`
+
+####Modifying SYSTEM|SESSION Level View Permissions
+Use the `ALTER SESSION|SYSTEM` command with the `new_view_default_permissions` parameter
and the appropriate octal code to set view permissions at the system or session level prior
to creating a view.
+ 
+    ALTER SESSION SET `new_view_default_permissions` = '<octal_code>';
+    ALTER SYSTEM SET `new_view_default_permissions` = '<octal_code>';
+ 
+Example: ``ALTER SESSION SET `new_view_default_permissions` = '777';``
+ 
+After you set this parameter, Drill applies the same permissions on each view created during
the session or across all sessions if set at the system level.
+
+## Chained Impersonation
+You can configure Drill to allow chained impersonation on views when you enable impersonation
in the `drill-override.conf` file. Chained impersonation controls the number of identity transitions
that Drill can make when a user queries a view. Each identity transition is equal to one hop.
+ 
+You can set the maximum number of hops on views to limit the number of times that Drill can
impersonate a different user when a user queries a view. The default maximum number of hops
is set at 3. When the maximum number of hops is set to 0, Drill does not allow impersonation
chaining, and a user can only read data for which they have direct permission to access. You
may set chain length to 0 to protect highly sensitive data. 
+ 
+The following example depicts a scenario where the maximum hop number is set to 3, and Drill
must impersonate three users to access data when Chad queries a view that Jane created:
+
+![](http://i.imgur.com/wwpStcs.png)
+
+In the previous example, Joe created a view V3 from views that user Frank created. In the
following example, Joe created view V3 by joining a view that Frank created with a view that
Bob created, thus increasing the number of identity transitions that Drill makes from 3 to
4, which exceeds the maximum hop setting of 3.
+ 
+In this scenario, when Chad queries Jane’s view Drill returns an error stating that the
query cannot complete because the number of hops required to access the data exceeds the maximum
hop setting of 3 that is configured.
+
+![](http://i.imgur.com/xO2yIDN.png)
+
+If users encounter this error, you can increase the maximum hop setting to accommodate users
running queries on views. When configuring the maximum number of hops that Drill can make,
consider that joined views increase the number of identity transitions required for Drill
to access the underlying data.
+
+#### Configuring Impersonation and Chaining
+Chaining is a system-wide setting that applies to all views. Currently, Drill does not provide
an option to  allow different chain lengths for different views.
+
+Complete the following steps on each Drillbit node to enable user impersonation, and set
the maximum number of chained user hops that Drill allows:
+
+1. Navigate to `<drill_installation_directory>/conf/` and edit `drill-override.conf`.
+2. Under `drill.exe`, add the following:
+
+          drill.exec.impersonation: {
+                enabled: true,
+                 max_chained_user_hops: 3
+          }
+
+3. Verify that enabled is set to `‘true’`.
+4. Set the maximum number of chained user hops that you want Drill to allow.
+5. (MapR cluster only) Add one of the following lines to the `drill-env.sh` file:
+   * If the underlying file system is not secure, add the following line:
+   ` export MAPR_IMPERSONATION_ENABLED=true`
+   * If the underlying file system has MapR security enabled, add the following line:
+    `export MAPR_TICKETFILE_LOCATION=/opt/mapr/conf/mapruserticket`
+6. Restart the Drillbit process on each Drill node.
+   * In a MapR cluster, run the following command:
+    `maprcli node services -name drill-bits -action restart -nodes <hostname> -f`
+   * In a non-MapR environment, run the following command:  
+     <DRILLINSTALL_HOME>/bin/drillbit.sh restart
+
+
+## Impersonation and Chaining Example
+Frank is a senior HR manager at a company. Frank has access to all of the employee data because
he is a member of the hr group. Frank created a table named “employees” in his home directory
to store the employee data he uses. Only Frank has access to this table.
+ 
+drwx------      frank:hr     /user/frank/employees
+ 
+Each record in the employees table consists of the following information:
+emp_id, emp_name, emp_ssn, emp_salary, emp_addr, emp_phone, emp_mgr
+ 
+Frank needs to share a subset of this information with Joe who is an HR manager reporting
to Frank. To share the employee data, Frank creates a view called emp_mgr_view that accesses
a subset of the data. The emp_mgr_view filters out sensitive employee information, such as
the employee social security numbers, and only shows data for the employees that report directly
to Joe or the manager running the query on the view. Frank and Joe both belong to the mgr
group. Managers have read permission on Frank’s directory.
+ 
+rwxr-----     frank:mgr   /user/frank/emp_mgr_view.drill.view
+ 
+The emp_mgr_view.drill.view file contains the following view definition:
+(view definition: SELECT emp_id, emp_name, emp_salary, emp_addr, emp_phone FROM \`/user/frank/employee\`
WHERE emp_mgr = user())
+ 
+When Joe issues SELECT * FROM emp_mgr_view, Drill impersonates Frank when accessing the employee
data, and the query returns the data that Joe has permission to see based on the view definition.
The query results do not include any sensitive data because the view protects that information.
If Joe tries to query the employees table directly, Drill returns an error or null values.
+ 
+Because Joe has read permissions on the emp_mgr_view, he can create new views from it to
give other users access to the employee data even though he does not own the employees table
and cannot access the employees table directly.
+ 
+Joe needs to share employee contact data with his direct reports, so he creates a special
view called emp_team_view to share the employee contact information with his team. Joe creates
the view and writes it to his home directory. Joe and his reports belong to a group named
joeteam. The joeteam group has read permissions on Joe’s home directory so they can query
the view and create new views from it.
+ 
+rwxr-----     joe:joeteam   /user/joe/emp_team_view.drill.view
+ 
+The emp_team_view.drill.view file contains the following view definition:
+ 
+(view definition: SELECT emp_id, emp_name, emp_phone FROM `/user/frank/emp_mgr_view.drill`);
+ 
+When anyone on Joe’s team issues SELECT * FROM emp_team_view, Drill impersonates Joe to
access the emp_team_view and then impersonates Frank to access the emp_mgr_view and the employee
data. Drill returns the data that Joe’s team has can see based on the view definition. If
anyone on Joe’s team tries to query the emp_mgr_view or employees table directly, Drill
returns an error or null values.
+ 
+Because Joe’s team has read permissions on the emp_team_view, they can create new views
from it and write the views to any directory for which they have write access. Creating views
can continue until Drill reaches the maximum number of impersonation hops.
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/drill/blob/26b0e529/_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md
----------------------------------------------------------------------
diff --git a/_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md b/_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md
deleted file mode 100644
index 978d374..0000000
--- a/_docs/manage-drill/013-configuring-a-multitenant-cluster-introduction.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-title: "Configuring a Multitenant Cluster Introduction"
-parent: "Configuring a Multitenant Cluster"
----
-
-Drill supports multiple users sharing a Drillbit. You can also run separate Drillbits running
on different nodes in the cluster.
-
-Drill typically runs along side other workloads, including the following:  
-
-* Mapreduce  
-* Yarn  
-* HBase  
-* Hive and Pig  
-* Spark  
-
-You need to plan and configure these resources for use with Drill and other workloads: 
-
-* [Memory]({{site.baseurl}}/docs/configuring-multitenant-resources)  
-* [CPU]({{site.baseurl}}/docs/configuring-multitenant-resources#how-to-manage-drill-cpu-resources)
 
-* Disk  
-
-Configure, memory, queues, and parallelization when users [share a Drillbit]({{site.baseurl}}/docs/configuring-resources-for-a-shared-drillbit).
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/drill/blob/26b0e529/_docs/manage-drill/013-configuring-a-multitenant-cluster.md
----------------------------------------------------------------------
diff --git a/_docs/manage-drill/013-configuring-a-multitenant-cluster.md b/_docs/manage-drill/013-configuring-a-multitenant-cluster.md
new file mode 100644
index 0000000..fe72675
--- /dev/null
+++ b/_docs/manage-drill/013-configuring-a-multitenant-cluster.md
@@ -0,0 +1,5 @@
+---
+title: "Configuring a Multitenant Cluster"
+parent: "Manage Drill"
+---
+

http://git-wip-us.apache.org/repos/asf/drill/blob/26b0e529/_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md
----------------------------------------------------------------------
diff --git a/_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md b/_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md
new file mode 100644
index 0000000..978d374
--- /dev/null
+++ b/_docs/manage-drill/014-configuring-a-multitenant-cluster-introduction.md
@@ -0,0 +1,22 @@
+---
+title: "Configuring a Multitenant Cluster Introduction"
+parent: "Configuring a Multitenant Cluster"
+---
+
+Drill supports multiple users sharing a Drillbit. You can also run separate Drillbits running
on different nodes in the cluster.
+
+Drill typically runs along side other workloads, including the following:  
+
+* Mapreduce  
+* Yarn  
+* HBase  
+* Hive and Pig  
+* Spark  
+
+You need to plan and configure these resources for use with Drill and other workloads: 
+
+* [Memory]({{site.baseurl}}/docs/configuring-multitenant-resources)  
+* [CPU]({{site.baseurl}}/docs/configuring-multitenant-resources#how-to-manage-drill-cpu-resources)
 
+* Disk  
+
+Configure, memory, queues, and parallelization when users [share a Drillbit]({{site.baseurl}}/docs/configuring-resources-for-a-shared-drillbit).
\ No newline at end of file


Mime
View raw message