Project: StarRocks (App Definition and Development / Database)
File: User_privilege.md

displayed_sidebar: "English" import UserPrivilegeCase from '../../assets/commonMarkdown/userPrivilegeCase.md' This topic describes how to manage users, roles, and privileges in StarRocks. StarRocks employs both role-based access control (RBAC) and identity-based access control (IBAC) to manage privileges within a StarRocks cluster, allowing cluster administrators to easily restrict privileges within the cluster on different granular levels. Within a StarRocks cluster, privileges can be granted to users or roles. A role is a collection of privileges that can be assigned to users or other roles in the cluster as needed. A user can be granted one or more roles, which determine their permissions on different objects. Users with the system-defined role `user_admin` can view all the user and role information within the StarRocks cluster. You can view the privileges granted to a user or a role using . View the privileges of the current user. ```SQL SHOW GRANTS; ``` > NOTE > > Any user can view their own privileges without needing any privileges. View the privileges of a specific user. The following example shows the privileges of the user `jack`: ```SQL SHOW GRANTS FOR jack@'172.10.1.10'; ``` View the privileges of a specific role. The following example shows the privileges of the role `example_role`: ```SQL SHOW GRANTS FOR ROLE example_role; ``` You can view the property of a user using . The following example shows the property of the user `jack`: ```SQL SHOW PROPERTY FOR jack@'172.10.1.10'; ``` You can view all the roles within the StarRocks cluster using . ```SQL SHOW ROLES; ``` You can view all the users within the StarRocks cluster using SHOW USERS. ```SQL SHOW USERS; ``` Users with the system-defined role `user_admin` can create users, alter users, and drop users in StarRocks. You can create a user by specifying the user identity, authentication method, and default role. StarRocks supports user authentication with login credentials or LDAP authentication. For more information about StarRocks' authentication, see . For more information and advanced instructions on creating a user, see . The following example creates the user `jack`, allows it to connect only from the IP address `172.10.1.10`, sets the password to `12345` for it, and assigns the role `example_role` to it as its default role: ```SQL CREATE USER jack@'172.10.1.10' IDENTIFIED BY '12345' DEFAULT ROLE 'example_role'; ``` NOTE StarRocks encrypts users' passwords before storing them. You can get the encrypted password using the password() function. A system-defined default role `PUBLIC` is assigned to a user if no default role is specified during user creation. You can alter the password, default role, or property for a user. The default role of a user is automatically activated when the user connects to StarRocks. For instructions on how to enable all (default and granted) roles for a user after connection, see . You can set the default role of a user using or . Both of the following examples set the default role of `jack` to `db1admin`. Note that `db1admin` must have been assigned to

Set the default role using SET DEFAULT ROLE: ```SQL SET DEFAULT ROLE 'db1_admin' TO jack@'172.10.1.10'; ``` Set the default role using ALTER USER: ```SQL ALTER USER jack@'172.10.1.10' DEFAULT ROLE 'db1_admin'; ``` You can set the property of a user using . The following example sets the maximum number of connections for user `jack` to `1000`. User identities that have the same user name share the same property. Therefore, you only need to set the property for `jack` and this setting takes effect for all the user identities with the user name `jack`. ```SQL SET PROPERTY FOR jack 'maxuserconnections' = '1000'; ``` You can reset the password for a user using or . NOTE Any user can reset their own passwords without needing any privileges. Only the `root` user itself can set its password. If you have lost its password and cannot connect to StarRocks, see for more instructions. Both the following examples reset the password of `jack` to `54321`: Reset the password using SET PASSWORD: ```SQL SET PASSWORD FOR jack@'172.10.1.10' = PASSWORD('54321'); ``` Reset the password using ALTER USER: ```SQL ALTER USER jack@'172.10.1.10' IDENTIFIED BY '54321'; ``` If you have lost the password of the `root` user and cannot connect to StarRocks, you can reset it by following these procedures: Add the following configuration item to the configuration files fe/conf/fe.conf of all FE nodes to disable user authentication: ```YAML enableauthcheck = false ``` Restart all FE nodes to allow the configuration to take effect. ```Bash ./fe/bin/stop_fe.sh ./fe/bin/start_fe.sh ``` Connect from a MySQL client to StarRocks via the `root` user. You do not need to specify the password when user authentication is disabled. ```Bash mysql -h <feiporfqdn> -P<fequery_port> -uroot ``` Reset the password for the `root` user. ```SQL SET PASSWORD for root = PASSWORD('xxxxxx'); ``` Re-enable user authentication by setting the configuration item `enableauthcheck` to `true` in the configuration files fe/conf/fe.conf of all FE nodes. ```YAML enableauthcheck = true ``` Restart all FE nodes to allow the configuration to take effect. ```Bash ./fe/bin/stop_fe.sh ./fe/bin/start_fe.sh ``` Connect from a MySQL client to StarRocks using the `root` user and the new password to verify whether the password is reset successfully. ```Bash mysql -h <feiporfqdn> -P<fequery_port> -uroot -p<xxxxxx> ``` You can drop a user using . The following example drops the user `jack`: ```SQL DROP USER jack@'172.10.1.10'; ``` Users with the system-defined role `user_admin` can create, grant, revoke, or drop roles in StarRocks. You can create a role using . By default, a user can have a maximum of 64 roles. You can adjust this setting by using the FE dynamic parameter `privilegemaxtotalrolesperuser`. A role can have a maximum of 16 inheritance levels. You can adjust this setting by using the FE dynamic parameter `privilegemaxroledepth`. The following example creates the role `example_role`: ```SQL CREATE ROLE example_role; ``` You can grant roles to a user or another role using . Grant a role to a user. The following example grants the role `example_role` to the user `jack`: ```SQL GRANT example_role TO USER jack@'172.10.1.10'; ``` Grant a role to another

The following example grants the role `examplerole` to the role `testrole`: ```SQL GRANT examplerole TO ROLE testrole; ``` You can revoke roles from a user or another role using . NOTE You cannot revoke the system-defined default role `PUBLIC` from a user. Revoke a role from a user. The following example revokes the role `example_role` from the user `jack`: ```SQL REVOKE example_role FROM USER jack@'172.10.1.10'; ``` Revoke a role from another role. The following example revokes the role `examplerole` from the role `testrole`: ```SQL REVOKE examplerole FROM ROLE testrole; ``` You can drop a role using . The following example drops the role `example_role`: ```SQL DROP ROLE example_role; ``` CAUTION System-defined roles cannot be dropped. The default roles of a user are roles that are automatically activated each time the user connects to the StarRocks cluster. If you want to enable all the roles (default and granted roles) for all StarRocks users when they connect to the StarRocks cluster, you can perform the following operation. This operation requires the system privilege OPERATE. ```SQL SET GLOBAL activateallrolesonlogin = TRUE; ``` You can also use SET ROLE to activate the roles assigned to you. For example, user `jack@'172.10.1.10'` has roles `dbadmin` and `useradmin` but they are not default roles of the user and are not automatically activated when the user connects to StarRocks. If jack@'172.10.1.10' needs to activate `dbadmin` and `useradmin`, he can run `SET ROLE dbadmin, useradmin;`. Note that SET ROLE overwrites original roles. If you want to enable all your roles, run SET ROLE ALL. Users with the system-defined role `user_admin` can grant or revoke privileges in StarRocks. You can grant privileges to a user or a role using . Grant a privilege to a user. The following example grants the SELECT privilege on the table `sr_member` to the user `jack`, and allows `jack` to grant this privilege to other users or roles (by specifying WITH GRANT OPTION in the SQL): ```SQL GRANT SELECT ON TABLE sr_member TO USER jack@'172.10.1.10' WITH GRANT OPTION; ``` Grant a privilege to a role. The following example grants the SELECT privilege on the table `srmember` to the role `examplerole`: ```SQL GRANT SELECT ON TABLE srmember TO ROLE examplerole; ``` You can revoke privileges from a user or a role using . Revoke a privilege from a user. The following example revokes the SELECT privilege on the table `sr_member` from the user `jack`, and disallows `jack` to grant this privilege to other users or roles: ```SQL REVOKE SELECT ON TABLE sr_member FROM USER jack@'172.10.1.10'; ``` Revoke a privilege from a role. The following example revokes the SELECT privilege on the table `srmember` from the role `examplerole`: ```SQL REVOKE SELECT ON TABLE srmember FROM ROLE examplerole; ``` Usually, a company-owned StarRocks cluster is managed by a sole service provider and maintains multiple lines of business (LOBs), each of which uses one or more databases. As shown below, a StarRocks cluster's users include members from the service provider and two LOBs (A and

Each LOB is operated by two roles - analysts and executives. Analysts generate and analyze business statements, and executives query the statements. LOB A independently manages the database `DBA`, and LOB B the database `DBB`. LOB A and LOB B use different tables in `DBC`. `DBPUBLIC` can be accessed by all members of both LOBs. Because different members perform different operations on different databases and tables, we recommend you create roles in accordance with their services and positions, apply only the necessary privileges to each role, and assign these roles to corresponding members. As shown below: Assign the system-defined roles `dbadmin`, `useradmin`, and `clusteradmin` to cluster maintainers, set `dbadmin` and `useradmin` as their default roles for daily maintenance, and manually activate the role `clusteradmin` when they need to operate the nodes of the cluster. Example: ```SQL GRANT dbadmin, useradmin, clusteradmin TO USER userplatform; ALTER USER userplatform DEFAULT ROLE dbadmin, user_admin; ``` Create users for each member within the LOBs, and set complex passwords for each user. Create roles for each position within the LOBs, and apply the corresponding privileges to each role. For the director of each LOB, grant their role the maximum collection of the privileges their LOBs need, and the corresponding GRANT privileges (by specifying WITH GRANT OPTION in the statement). Therefore, they can assign these privileges to the members of their LOB. Set the role as their default role if their daily work requires it. Example: ```SQL GRANT SELECT, ALTER, INSERT, UPDATE, DELETE ON ALL TABLES IN DATABASE DBA TO ROLE lineaadmin WITH GRANT OPTION; GRANT SELECT, ALTER, INSERT, UPDATE, DELETE ON TABLE TABLEC1, TABLEC2, TABLEC3 TO ROLE lineaadmin WITH GRANT OPTION; GRANT lineaadmin TO USER userlinea_admin; ALTER USER userlineaadmin DEFAULT ROLE linea_admin; ``` For analysts and executives, assign them the role with the corresponding privileges. Example: ```SQL GRANT SELECT ON ALL TABLES IN DATABASE DBA TO ROLE lineaquery; GRANT SELECT ON TABLE TABLEC1, TABLEC2, TABLEC3 TO ROLE lineaquery; GRANT lineaquery TO USER userlinea_salesa; GRANT lineaquery TO USER userlinea_salesb; ALTER USER userlineasalesa DEFAULT ROLE linea_query; ALTER USER userlineasalesb DEFAULT ROLE linea_query; ``` For the database `DBPUBLIC`, which can be accessed by all cluster users, grant the SELECT privilege on `DBPUBLIC` to the system-defined role `public`. Example: ```SQL GRANT SELECT ON ALL TABLES IN DATABASE DB_PUBLIC TO ROLE public; ``` You can assign roles to others to achieve role inheritance in complicated scenarios. For example, if analysts require privileges to write into and query tables in `DBPUBLIC`, and executives can only query these tables, you can create roles `publicanalysis` and `public_sales`, apply relevant privileges to the roles, and assign them to the original roles of analysts and executives respectively. Example: ```SQL CREATE ROLE public_analysis; CREATE ROLE public_sales; GRANT SELECT, ALTER, INSERT, UPDATE, DELETE ON ALL TABLES IN DATABASE DBPUBLIC TO ROLE publicanalysis; GRANT SELECT ON ALL TABLES IN DATABASE DBPUBLIC TO ROLE publicsales; GRANT publicanalysis TO ROLE lineaanalysis; GRANT publicanalysis TO ROLE linebanalysis; GRANT publicsales TO ROLE lineaquery; GRANT publicsales TO ROLE linebquery; ``` <UserPrivilegeCase />