下述为 MySQL 用户管理语法树：

  1. create_user_stmt:
  2.     CREATE USER [IF NOT EXISTS] user_name [IDENTIFIED BY 'password'];
  4. alter_user_stmt:
  5.       ALTER USER user_name ACCOUNT {LOCK | UNLOCK};
  6.     | ALTER USER user_name IDENTIFIED BY 'password';
  7.     | SET PASSWORD [FOR user_name] = PASSWORD('password');
  8.     | RENAME USER rename_user_action_list;
  10. drop_user_stmt:
  11.     DROP USER user_name_list;
  13. rename_user_action_list:
  14.     rename_user_action [, rename_user_action ...]
  16. rename_user_action:
  17.     user_name TO user_name
  19. user_name_list:
  20.     user_name [, user_name ...]
  22. password:
  23.     STR_VALUE

下述为用户权限管理语句的语法：

  1. grant_stmt:
  2.     GRANT privilege_type_list ON privilege_level TO user_option_list [WITH GRANT OPTION];
  4. revoke_stmt:
  5.     REVOKE privilege_type_list ON privilege_level FROM user_name_list;
  7. show_grants_stmt:
  8.     SHOW GRANTS [FOR user_name];
  10. privilege_type_list:
  11.     {ALL [PRIVILEGES] | privilege_type [, privilege_type ...]}
  13. privilege_type:
  14.       ALTER
  15.     | CREATE
  16.     | CREATE USER
  17.     | CREATE VIEW
  18.     | DELETE
  19.     | DROP
  20.     | GRANT OPTION
  21.     | INDEX
  22.     | INSERT
  23.     | PROCESS
  24.     | SELECT
  25.     | SHOW DATABASES
  26.     | SHOW VIEW
  27.     | SUPER
  28.     | UPDATE
  29.     | USAGE
  31. privilege_level:
  32.       *
  33.     | *.*
  34.     | database_name.*
  35.     | database_name.table_name
  36.     | table_name
  38. user_option_list:
  39.     user_option [, user_option ...]
  41. user_option:
  42.     user_name [IDENTIFIED BY 'password']
  44. password:
  45.     STR_VALUE
  47. user_name_list:
  48.     user_name [, user_name ...]

白名单管理

ob_tcp_invited_nodes 参数是租户全局的白名单限制参数。运行下述语句查看该参数以确认白名单：

  1. obclient> SHOW VARIABLES LIKE "ob_tcp_invited_nodes";
  2. +----------------------+-------+
  3. | Variable_name        | Value |
  4. +----------------------+-------+
  5. | ob_tcp_invited_nodes | %     |
  6. +----------------------+-------+

权限限制

Lock 用户操作：

  1. obclient> ALTER USER demo ACCOUNT LOCK;
  2. Query OK, 0 rows affected (0.02 sec)
  4. obclient -udemo@demo0_111 -P2881 -h10.10.10.1   -pttt
  5. obclient: [Warning] Using a password on the command line interface can be insecure.
  6. ERROR 3118 (HY000): User locked

Unlock 用户操作：

  1. obclient> ALTER USER demo ACCOUNT UNLOCK;
  2. Query OK, 0 rows affected (0.02 sec)
  4. obclient -udemo@demo0_111 -P2881 -h10.10.10.1   -pttt
  5. obclient: [Warning] Using a password on the command line interface can be insecure.
  6. Welcome to the OceanBase monitor.  Commands end with ; or \g.
  7. Your OceanBase connection id is 3222145887
  8. Server version: 5.7.25 OceanBase 2.2.30 (r20200715203914-b36a08355d624ed1923c4782d11e06a92441cebe) (Built Jul 15 2020 21:30:23)
  10. Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
  12. Oracle is a registered trademark of Oracle Corporation and/or its
  13. affiliates. Other names may be trademarks of their respective
  14. owners.
  16. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
  18. obclient>

权限授予操作：

  1. obclient> GRANT ALL PRIVILEGES ON *.* TO demo with grant option;

权限摘除操作：

  1. obclient> REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'demo';
  2. Query OK, 0 rows affected (0.03 sec)