AMBARI-3643: Ambari should set correct authorization and authenticator manager for Hive in secure environment.(jaimin)

ambari-server/src/main/resources/stacks/HDP/1.3.2/services/HIVE/configuration/hive-site.xml

@@ -101,7 +101,7 @@ limitations under the License.
 
   <property>
     <name>hive.security.authorization.enabled</name>
-    <value>true</value>
+    <value>false</value>
     <description>enable or disable the hive client authorization</description>
   </property>
 

ambari-server/src/main/resources/stacks/HDP/1.3.3/services/HIVE/configuration/hive-site.xml

@@ -101,7 +101,7 @@ limitations under the License.
 
   <property>
     <name>hive.security.authorization.enabled</name>
-    <value>true</value>
+    <value>false</value>
     <description>enable or disable the hive client authorization</description>
   </property>
 

ambari-server/src/main/resources/stacks/HDP/2.0.6/services/HIVE/configuration/hive-site.xml

@@ -107,11 +107,23 @@ limitations under the License.
 
   <property>
     <name>hive.security.authorization.manager</name>
-    <value>org.apache.hadoop.hive.ql.security.authorization.DefaultHiveAuthorizationProvider</value>
+    <value>org.apache.hadoop.hive.ql.security.authorization.StorageBasedAuthorizationProvider</value>
     <description>the hive client authorization manager class name.
     The user defined authorization class should implement interface org.apache.hadoop.hive.ql.security.authorization.HiveAuthorizationProvider.  </description>
   </property>
 
+  <property>
+    <name>hive.security.metastore.authorization.manager</name>
+    <value>org.apache.hadoop.hive.ql.security.authorization.StorageBasedAuthorizationProvider</value>
+    <description>The authorization manager class name to be used in the metastore for authorization. The user-defined authorization class should implement interface org.apache.hadoop.hive.ql.security.authorization.HiveMetastoreAuthorizationProvider.  </description>
+  </property>
+
+  <property>
+    <name>hive.security.authenticator.manager</name>
+    <value>org.apache.hadoop.hive.ql.security.ProxyUserAuthenticator</value>
+    <description>Hive client authenticator manager class name. The user-defined authenticator class should implement interface org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider.  </description>
+  </property>
+
   <property>
     <name>hive.server2.enable.doAs</name>
     <value>true</value>

ambari-server/src/main/resources/stacks/HDPLocal/1.3.2/services/HIVE/configuration/hive-site.xml

@@ -101,7 +101,7 @@ limitations under the License.
 
   <property>
     <name>hive.security.authorization.enabled</name>
-    <value>true</value>
+    <value>false</value>
     <description>enable or disable the hive client authorization</description>
   </property>
 

ambari-server/src/main/resources/stacks/HDPLocal/1.3.3/services/HIVE/configuration/hive-site.xml

@@ -101,7 +101,7 @@ limitations under the License.
 
   <property>
     <name>hive.security.authorization.enabled</name>
-    <value>true</value>
+    <value>false</value>
     <description>enable or disable the hive client authorization</description>
   </property>
 

ambari-server/src/main/resources/stacks/HDPLocal/2.0.6/services/HIVE/configuration/hive-site.xml

@@ -107,11 +107,23 @@ limitations under the License.
 
   <property>
     <name>hive.security.authorization.manager</name>
-    <value>org.apache.hadoop.hive.ql.security.authorization.DefaultHiveAuthorizationProvider</value>
+    <value>org.apache.hadoop.hive.ql.security.authorization.StorageBasedAuthorizationProvider</value>
     <description>the hive client authorization manager class name.
       The user defined authorization class should implement interface org.apache.hadoop.hive.ql.security.authorization.HiveAuthorizationProvider.  </description>
   </property>
 
+  <property>
+    <name>hive.security.metastore.authorization.manager</name>
+    <value>org.apache.hadoop.hive.ql.security.authorization.StorageBasedAuthorizationProvider</value>
+    <description>The authorization manager class name to be used in the metastore for authorization. The user-defined authorization class should implement interface org.apache.hadoop.hive.ql.security.authorization.HiveMetastoreAuthorizationProvider.  </description>
+  </property>
+
+  <property>
+    <name>hive.security.authenticator.manager</name>
+    <value>org.apache.hadoop.hive.ql.security.ProxyUserAuthenticator</value>
+    <description>Hive client authenticator manager class name. The user-defined authenticator class should implement interface org.apache.hadoop.hive.ql.security.HiveAuthenticationProvider.  </description>
+  </property>
+
   <property>
     <name>hive.server2.enable.doAs</name>
     <value>true</value>

ambari-web/app/controllers/main/admin/security/disable.js

@@ -411,6 +411,9 @@ App.MainAdminSecurityDisableController = Em.Controller.extend({
                 case 'zookeeper.znode.parent':
                   _serviceConfigTags.configs[configName] = '/hbase-unsecure';
                   break;
+                case 'hive.security.authorization.enabled':
+                  _serviceConfigTags.configs[configName] = 'false';
+                  break;
                 default:
                   delete _serviceConfigTags.configs[configName];
               }

ambari-web/app/data/HDP2/secure_mapping.js

@@ -305,6 +305,14 @@ module.exports = [
     "filename": "hive-site.xml",
     "serviceName": "HIVE"
   },
+  {
+    "name": "hive.security.authorization.enabled",
+    "templateName": [],
+    "foreignKey": null,
+    "value": "true",
+    "filename": "hive-site.xml",
+    "serviceName": "HIVE"
+  },
   {
     "name": "hive.server2.authentication",
     "templateName": [],

ambari-web/app/data/secure_mapping.js

@@ -234,6 +234,14 @@ module.exports = [
     "filename": "hive-site.xml",
     "serviceName": "HIVE"
   },
+  {
+    "name": "hive.security.authorization.enabled",
+    "templateName": [],
+    "foreignKey": null,
+    "value": "true",
+    "filename": "hive-site.xml",
+    "serviceName": "HIVE"
+  },
   {
     "name": "hive.server2.authentication",
     "templateName": [],