Apache Sentry

Definition

Apache Sentry was a role-based authorization system that provided fine-grained, centralized access control for data stored in Hadoop components such as Hive, Impala, and HDFS. It let administrators define roles with specific privileges over databases, tables, and columns and assign those roles to users or groups, giving Hadoop clusters a unified permission model before being retired by the Apache Software Foundation in favor of Apache Ranger.

Overview

In the early growth of the Hadoop ecosystem, individual components handled authorization independently and inconsistently: HDFS relied on POSIX-style permissions, while query engines like Hive had their own, separate grant mechanisms. Apache Sentry emerged to address this fragmentation by offering a single, role-based authorization layer that multiple Hadoop services could plug into, so a cluster's access rules could be defined and reasoned about in one place. Sentry worked by defining roles as named bundles of privileges, such as select access on a particular table or all privileges on a database, and then binding those roles to users or to groups resolved through a directory service. Components like Hive and Impala integrated with Sentry through a binding layer that checked incoming queries against the active role assignments before allowing execution, and metadata about roles and privileges was stored centrally so that policy remained consistent regardless of which entry point a user queried through. This meant a user granted select access on a table through Sentry would see that permission enforced identically whether they queried via Hive or Impala. Sentry's closest peer was Apache Ranger, which took a broader approach by supporting more Hadoop components, offering attribute and tag-based policies in addition to roles, and providing a richer web console and centralized audit trail. As the Hadoop ecosystem matured, the community consolidated around Ranger, and Sentry was formally retired by the Apache Software Foundation, with its codebase moved to the Apache Attic where inactive projects are archived. While it was active, Sentry was primarily used by organizations running Cloudera-distributed Hadoop clusters that needed table- and column-level access control for Hive and Impala without building custom authorization logic into every application querying the cluster. Administrators would define a small set of roles mirroring organizational functions, such as an analyst role with read access to reporting tables, and manage group membership through existing directory infrastructure rather than granting permissions to individual users directly, which kept privilege reviews manageable even as the number of tables and users on a cluster grew substantially. Because Sentry is retired, it should not be adopted for new deployments; its documentation and downloads remain available mainly for historical reference and for organizations still operating legacy clusters that have not yet migrated. Any team evaluating Hadoop authorization today is directed toward Ranger, which superseded Sentry's functionality and continues to receive active development and community support, including broader component coverage and richer policy types than Sentry ever offered.

Key Features

• Role-based access control model for Hadoop query engines
• Centralized privilege definitions shared across Hive and Impala
• Group-based role assignment integrated with directory services
• Table- and column-level granularity for sensitive data access
• Consistent policy enforcement regardless of query entry point
• Now retired and archived in the Apache Attic

Use Cases

Alternatives

Frequently Asked Questions

Related in Database