Greenplum中角色权限及客户端认证管理

角色权限及客户端认证管理

GP数据库逻辑结构

在GP中，Database（数据库）、Schema（模式）以及Role（角色）三者之间的关系如下所示：

一个数据库下可以有多个模式，一个模式只属于一个数据库。模式在GP中也被称为Namespace，不同数据库之间的模式没有关系，可以重名；
语言在使用之前必须创建，一个语言只属于一个数据库；
表、视图、索引、序列、函数必须属于一个模式；
一个文件空间可以有多个表空间，一个表空间只属于一个文件空间，文件空间和角色之间没有关系；
表空间和表时一对多的关系，一个模式下的表可以分布在多个表空间下；
除了文件空间之外，其他的权限管理都是通过角色来实现，在这些层次结构中，用户必须对上一层有访问权限才能够访问该层的内容；

什么是角色(role)

Role的组成：由用户(User)和组(Group)组成；
跟OS的role没有关系；
User通过Master节点登录和认证的；
Role是定义在GPDB系统级别的；
初始化SUPERUSERROLE：gpadmin。

角色与权限安全的最佳实践

保护系统gpadmin的用户；
为每个登录的User分配不同的角色；
使用组来管理权限从而实现管理组；
控制具备SUPERUSER属性的User数量。

创建Role

创建用户User Role

使用CREATE ROLE创建一个User Role，语法如下所示：

template1-# ]\h create role

Command: CREATE ROLE

Description: define a new database role

Syntax:

CREATE ROLE name [[WITH] option [ ... ]]

where option can be:

SUPERUSER | NOSUPERUSER

| CREATEDB | NOCREATEDB

| CREATEROLE | NOCREATEROLE

| CREATEEXTTABLE | NOCREATEEXTTABLE

[ ( attribute='value'[, ...] ) ]

where attributes and values are:

type='readable'|'writable'

protocol='gpfdist'|'http'|'gphdfs'

| INHERIT | NOINHERIT

| LOGIN | NOLOGIN

| CONNECTION LIMIT connlimit

| [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password'

| VALID UNTIL 'timestamp'

| IN ROLE rolename [, ...]

| ROLE rolename [, ...]

| ADMIN rolename [, ...]

| RESOURCE QUEUE queue_name

例如： # CREATE ROLE mavshuangWITH LOGIN;

template1=# CREATE ROLE mavshuang WITH LOGIN;

NOTICE: resource queue required -- using default resource queue "pg_default"

CREATE ROLE

ALTER ROLE属性

使用ALTER ROLE修改角色的属性，语法如下所示：

template1-# \h alter role

Command: ALTER ROLE

Description: change a database role

Syntax:

ALTER ROLE name RENAME TO newname

ALTER ROLE name SET config_parameter {TO | =} {value | DEFAULT}

ALTER ROLE name RESET config_parameter

ALTER ROLE name RESOURCE QUEUE {queue_name | NONE}

ALTER ROLE name [ [WITH] option [ ... ] ]

where option can be:

SUPERUSER | NOSUPERUSER

| CREATEDB | NOCREATEDB

| CREATEROLE | NOCREATEROLE

| CREATEEXTTABLE | NOCREATEEXTTABLE

[ ( attribute='value'[, ...] ) ]

where attributes and values are:

type='readable'|'writable'

protocol='gpfdist'|'http'|'gphdfs'

| INHERIT | NOINHERIT

| LOGIN | NOLOGIN

| CONNECTION LIMIT connlimit

| [ENCRYPTED | UNENCRYPTED] PASSWORD 'password'

| VALID UNTIL 'timestamp'

创建组Group Role

使用CREATE ROLE创建一个GroupRole:

=#CREATE ROLE admin CREATEROLE CREATEDB;

template1=# \du

List of roles

Role name | Attributes | Member of

-----------+--------------------------------------+-----------

admin | Create role, Create DB, Cannot login |

gpadmin | Superuser, Create role, Create DB |

mavshuang | |

添加或删除Member(UserRole)

使用GRANT关键字授权，使用REVOKE关键字取消授权；

template1=# \h GRANT

Command: GRANT

Description: define access privileges

Syntax:

GRANT { { SELECT | INSERT | UPDATE | DELETE | REFERENCES | TRIGGER }

[,...] | ALL [ PRIVILEGES ] }

ON [ TABLE ] tablename [, ...]

TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]

GRANT { { USAGE | SELECT | UPDATE }

[,...] | ALL [ PRIVILEGES ] }

ON SEQUENCE sequencename [, ...]

TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]

GRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }

ON DATABASE dbname [, ...]

TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]

GRANT { EXECUTE | ALL [ PRIVILEGES ] }

ON FUNCTION funcname ( [ [ argmode ] [ argname ] argtype [, ...] ] ) [, ...]

TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]

GRANT { USAGE | ALL [ PRIVILEGES ] }

ON LANGUAGE langname [, ...]

TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]

GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }

ON SCHEMA schemaname [, ...]

TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]

GRANT { CREATE | ALL [ PRIVILEGES ] }

ON TABLESPACE tablespacename [, ...]

TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]

GRANT role [, ...] TO username [, ...] [ WITH ADMIN OPTION ]

GRANT { SELECT | INSERT | ALL [PRIVILEGES] }

..ON PROTOCOL protocolname

..TO username

template1=# \h REVOKE

Command: REVOKE

Description: remove access privileges

Syntax:

REVOKE [ GRANT OPTION FOR ]

{ { SELECT | INSERT | UPDATE | DELETE | REFERENCES | TRIGGER }

[,...] | ALL [ PRIVILEGES ] }

ON [ TABLE ] tablename [, ...]