Skip to content

Commit 16a5f7a

Browse files
yifuzhouyifuzhou
authored
[IOTDB-4153]Grant ALL privileges to different paths return privilege exists (apache#7023)
[IOTDB-4153]Grant ALL privileges to different paths return privilege exists (apache#7023)
1 parent 3dddfe9 commit 16a5f7a

File tree

6 files changed

+243
-92
lines changed

6 files changed

+243
-92
lines changed

‎antlr/src/main/antlr4/org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -537,7 +537,7 @@ grantUser
537537

538538
// Grant Role Privileges
539539
grantRole
540-
: GRANT ROLE roleName=identifier PRIVILEGES privileges ON prefixPath (COMMA prefixPath)*
540+
: GRANT ROLE roleName=identifier PRIVILEGES privileges (ON prefixPath (COMMA prefixPath)*)?
541541
;
542542

543543
// Grant User Role
@@ -552,7 +552,7 @@ revokeUser
552552

553553
// Revoke Role Privileges
554554
revokeRole
555-
: REVOKE ROLE roleName=identifier PRIVILEGES privileges ON prefixPath (COMMA prefixPath)*
555+
: REVOKE ROLE roleName=identifier PRIVILEGES privileges (ON prefixPath (COMMA prefixPath)*)?
556556
;
557557

558558
// Revoke Role From User

‎docs/UserGuide/Administration-Management/Administration.md‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -184,27 +184,29 @@ Eg: IoTDB > DROP ROLE `admin`;
184184
```
185185
GRANT USER <userName> PRIVILEGES <privileges> ON <nodeNames>;
186186
Eg: IoTDB > GRANT USER `tempuser` PRIVILEGES INSERT_TIMESERIES, DELETE_TIMESERIES on root.ln.**, root.sgcc.**;
187+
Eg: IoTDB > GRANT USER `tempuser` PRIVILEGES CREATE_ROLE;
187188
```
188189

189190
- Grant User All Privileges
190191

191192
```
192-
GRANT USER <userName> PRIVILEGES ALL ON <nodeNames>;
193-
Eg: IoTDB > grant user renyuhua privileges all on root.sgcc.**, root.**;
193+
GRANT USER <userName> PRIVILEGES ALL;
194+
Eg: IoTDB > GRANT USER `tempuser` PRIVILEGES ALL;
194195
```
195196

196197
* Grant Role Privileges
197198

198199
```
199200
GRANT ROLE <roleName> PRIVILEGES <privileges> ON <nodeNames>;
200201
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES INSERT_TIMESERIES, DELETE_TIMESERIES ON root.sgcc.**, root.ln.**;
202+
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES CREATE_ROLE;
201203
```
202204

203205
- Grant Role All Privileges
204206

205207
```
206208
GRANT ROLE <roleName> PRIVILEGES ALL ON <nodeNames>;
207-
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES ALL ON root.ln.**;
209+
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES ALL;
208210
```
209211

210212
* Grant User Role
@@ -219,27 +221,29 @@ Eg: IoTDB > GRANT `temprole` TO tempuser;
219221
```
220222
REVOKE USER <userName> PRIVILEGES <privileges> ON <nodeNames>;
221223
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES DELETE_TIMESERIES on root.ln.**;
224+
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES CREATE_ROLE;
222225
```
223226

224227
* Revoke User All Privileges
225228

226229
```
227-
REVOKE USER <userName> PRIVILEGES ALL ON <nodeNames>;
228-
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES ALL on root.ln.**;
230+
REVOKE USER <userName> PRIVILEGES ALL;
231+
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES ALL;
229232
```
230233

231234
* Revoke Role Privileges
232235

233236
```
234237
REVOKE ROLE <roleName> PRIVILEGES <privileges> ON <nodeNames>;
235238
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES DELETE_TIMESERIES ON root.ln.**;
239+
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES CREATE_ROLE;
236240
```
237241

238242
* Revoke All Role Privileges
239243

240244
```
241-
REVOKE ROLE <roleName> PRIVILEGES ALL ON <nodeNames>;
242-
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES ALL ON root.ln.**;
245+
REVOKE ROLE <roleName> PRIVILEGES ALL;
246+
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES ALL;
243247
```
244248

245249
* Revoke Role From User
@@ -396,6 +400,8 @@ At the same time, changes to roles are immediately reflected on all users who ow
396400
|APPLY_TEMPLATE|set, unset and activate schema template; path dependent|Eg1: `set schema template t1 to root.sg.d`<br/>Eg2: `create timeseries of schema template on root.sg.d`
397401
|READ_TEMPLATE_APPLICATION|show paths set and using schema template; path independent|Eg1: `show paths set schema template t1`<br/>Eg2: `show paths using schema template t1`
398402

403+
Note that path dependent privileges can only be granted or revoked on root.**;
404+
399405
Note that the following SQL statements need to be granted multiple permissions before they can be used：
400406

401407
- Import data: Need to assign `READ_TIMESERIES`，`INSERT_TIMESERIES` two permissions.。

‎docs/zh/UserGuide/Administration-Management/Administration.md‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -183,27 +183,29 @@ Eg: IoTDB > DROP ROLE `admin`;
183183
```
184184
GRANT USER <userName> PRIVILEGES <privileges> ON <nodeNames>;
185185
Eg: IoTDB > GRANT USER `tempuser` PRIVILEGES INSERT_TIMESERIES, DELETE_TIMESERIES on root.ln.**, root.sgcc.**;
186+
Eg: IoTDB > GRANT USER `tempuser` PRIVILEGES CREATE_ROLE;
186187
```
187188

188189
- 赋予用户全部的权限
189190

190191
```
191-
GRANT USER <userName> PRIVILEGES ALL ON <nodeNames>;
192-
Eg: IoTDB > grant user renyuhua privileges all on root.sgcc.**, root.**;
192+
GRANT USER <userName> PRIVILEGES ALL;
193+
Eg: IoTDB > GRANT USER `tempuser` PRIVILEGES ALL;
193194
```
194195

195196
* 赋予角色权限
196197

197198
```
198199
GRANT ROLE <roleName> PRIVILEGES <privileges> ON <nodeNames>;
199200
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES INSERT_TIMESERIES, DELETE_TIMESERIES ON root.sgcc.**, root.ln.**;
201+
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES CREATE_ROLE;
200202
```
201203

202204
- 赋予角色全部的权限
203205

204206
```
205-
GRANT ROLE <roleName> PRIVILEGES ALL ON <nodeNames>;
206-
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES ALL ON root.ln.**;
207+
GRANT ROLE <roleName> PRIVILEGES ALL;
208+
Eg: IoTDB > GRANT ROLE `temprole` PRIVILEGES ALL;
207209
```
208210

209211
* 赋予用户角色
@@ -218,27 +220,29 @@ Eg: IoTDB > GRANT `temprole` TO tempuser;
218220
```
219221
REVOKE USER <userName> PRIVILEGES <privileges> ON <nodeNames>;
220222
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES DELETE_TIMESERIES on root.ln.**;
223+
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES CREATE_ROLE;
221224
```
222225

223226
- 移除用户所有权限
224227

225228
```
226-
REVOKE USER <userName> PRIVILEGES ALL ON <nodeNames>;
227-
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES ALL on root.ln.**;
229+
REVOKE USER <userName> PRIVILEGES ALL;
230+
Eg: IoTDB > REVOKE USER `tempuser` PRIVILEGES ALL;
228231
```
229232

230233
* 撤销角色权限
231234

232235
```
233236
REVOKE ROLE <roleName> PRIVILEGES <privileges> ON <nodeNames>;
234237
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES DELETE_TIMESERIES ON root.ln.**;
238+
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES CREATE_ROLE;
235239
```
236240

237241
- 撤销角色全部的权限
238242

239243
```
240-
REVOKE ROLE <roleName> PRIVILEGES ALL ON <nodeNames>;
241-
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES ALL ON root.ln.**;
244+
REVOKE ROLE <roleName> PRIVILEGES ALL;
245+
Eg: IoTDB > REVOKE ROLE `temprole` PRIVILEGES ALL;
242246
```
243247

244248
* 撤销用户角色
@@ -395,6 +399,8 @@ Eg: IoTDB > ALTER USER `tempuser` SET PASSWORD 'newpwd';
395399
|APPLY_TEMPLATE|挂载、卸载、激活模板。路径有关。|Eg1: `set schema template t1 to root.sg.d`<br/>Eg2: `create timeseries of schema template on root.sg.d`
396400
|READ_TEMPLATE_APPLICATION|查看模板的挂载路径和激活路径。路径无关|Eg1: `show paths set schema template t1`<br/>Eg2: `show paths using schema template t1`
397401

402+
注意： 路径无关的权限只能在路径root.**下赋予或撤销；
403+
398404
注意: 下述sql语句需要赋予多个权限才可以使用：
399405

400406
- 导入数据，需要赋予`READ_TIMESERIES`，`INSERT_TIMESERIES`两种权限。

‎integration/src/test/java/org/apache/iotdb/db/integration/IoTDBAuthorizationIT.java‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1398,4 +1398,94 @@ public void testEmptySetAuthorityCheck() throws ClassNotFoundException, SQLExcep
13981398
assertFalse(resultSet.next());
13991399
}
14001400
}
1401+
1402+
@Test
1403+
public void testCheckGrantRevokePrivileges() throws ClassNotFoundException, SQLException {
1404+
Class.forName(Config.JDBC_DRIVER_NAME);
1405+
try (Connection adminCon =
1406+
DriverManager.getConnection(
1407+
Config.IOTDB_URL_PREFIX + "127.0.0.1:6667/", "root", "root");
1408+
Statement adminStmt = adminCon.createStatement()) {
1409+
adminStmt.execute("CREATE USER tempuser 'temppw'");
1410+
1411+
adminStmt.execute("GRANT USER tempuser PRIVILEGES ALL on root.**");
1412+
adminStmt.execute("REVOKE USER tempuser PRIVILEGES ALL on root.**");
1413+
adminStmt.execute("GRANT USER tempuser PRIVILEGES ALL");
1414+
adminStmt.execute(
1415+
"GRANT USER tempuser PRIVILEGES INSERT_TIMESERIES, READ_TIMESERIES on root.ln.**");
1416+
adminStmt.execute(
1417+
"REVOKE USER tempuser PRIVILEGES INSERT_TIMESERIES, READ_TIMESERIES on root.ln.**");
1418+
boolean caught = false;
1419+
try {
1420+
adminStmt.execute("GRANT USER tempuser PRIVILEGES ALL on root.ln.**");
1421+
} catch (Exception e) {
1422+
caught = true;
1423+
}
1424+
assertTrue(caught);
1425+
1426+
caught = false;
1427+
try {
1428+
adminStmt.execute("REVOKE USER tempuser PRIVILEGES ALL on root.ln.**");
1429+
} catch (Exception e) {
1430+
caught = true;
1431+
}
1432+
assertTrue(caught);
1433+
1434+
caught = false;
1435+
try {
1436+
adminStmt.execute("GRANT USER tempuser PRIVILEGES INSERT_TIMESERIES, ALL on root.ln.**");
1437+
} catch (Exception e) {
1438+
caught = true;
1439+
}
1440+
assertTrue(caught);
1441+
1442+
caught = false;
1443+
try {
1444+
adminStmt.execute("REVOKE USER tempuser PRIVILEGES INSERT_TIMESERIES, ALL on root.ln.**");
1445+
} catch (Exception e) {
1446+
caught = true;
1447+
}
1448+
assertTrue(caught);
1449+
1450+
adminStmt.execute("CREATE ROLE temprole");
1451+
adminStmt.execute("GRANT ROLE temprole PRIVILEGES ALL on root.**");
1452+
adminStmt.execute("REVOKE ROLE temprole PRIVILEGES ALL on root.**");
1453+
adminStmt.execute("GRANT ROLE temprole PRIVILEGES ALL");
1454+
adminStmt.execute(
1455+
"GRANT ROLE temprole PRIVILEGES INSERT_TIMESERIES, READ_TIMESERIES on root.ln.**");
1456+
adminStmt.execute(
1457+
"REVOKE ROLE temprole PRIVILEGES INSERT_TIMESERIES, READ_TIMESERIES on root.ln.**");
1458+
caught = false;
1459+
try {
1460+
adminStmt.execute("GRANT ROLE temprole PRIVILEGES ALL on root.ln.**");
1461+
} catch (Exception e) {
1462+
caught = true;
1463+
}
1464+
assertTrue(caught);
1465+
1466+
caught = false;
1467+
try {
1468+
adminStmt.execute("REVOKE ROLE temprole PRIVILEGES ALL on root.ln.**");
1469+
} catch (Exception e) {
1470+
caught = true;
1471+
}
1472+
assertTrue(caught);
1473+
1474+
caught = false;
1475+
try {
1476+
adminStmt.execute("GRANT ROLE temprole PRIVILEGES INSERT_TIMESERIES, ALL on root.ln.**");
1477+
} catch (Exception e) {
1478+
caught = true;
1479+
}
1480+
assertTrue(caught);
1481+
1482+
caught = false;
1483+
try {
1484+
adminStmt.execute("REVOKE ROLE temprole PRIVILEGES INSERT_TIMESERIES, ALL on root.ln.**");
1485+
} catch (Exception e) {
1486+
caught = true;
1487+
}
1488+
assertTrue(caught);
1489+
}
1490+
}
14011491
}

0 commit comments

Comments
 (0)