CREATE USER MAPPING

Description

CREATE USER MAPPING defines a new mapping from a user to a foreign server.

Precautions

If the password option is displayed, ensure that the usermapping.key.cipher and usermapping.key.rand files exist in the $GAUSSHOME/bin directory of each node in GaussDB. If the two files do not exist, use the gs_guc tool to generate them and use the gs_ssh tool to release them to the $GAUSSHOME/bin directory on each node in GaussDB.

When multi-layer quotation marks are used for sensitive columns (such as password) in OPTIONS, the semantics is different from that in the scenario where quotation marks are not used. Therefore, sensitive columns are not identified for anonymization.

Syntax

CREATE USER MAPPING FOR { user_name | USER | CURRENT_USER | PUBLIC }
    SERVER server_name
    [ OPTIONS ( option 'value' [ , ... ] ) ]

Parameters

• user_name

  Specifies the name of an existing user to map to a foreign server.

  CURRENT_USER and USER match the name of the current user. When PUBLIC is specified, a public mapping is created and used when no mapping for a particular user is available.

• server_name

  Specifies the name of the existing server for which a user mapping will be created.

• OPTIONS ( { option_name ' value ' } [, ...] )

  Specifies options for user mapping. These options typically define the actual user name and password for this mapping. The option name must be unique. The allowed option names and values are related to the foreign data wrapper of the server.

  

  • User passwords are encrypted and stored in the system catalog PG_USER_MAPPING. During the encryption, usermapping.key.cipher and usermapping.key.rand are used as the encryption password file and encryption factor. Before using the tool for the first time, run the following command to create the two files, save the files to the $GAUSSHOME/bin directory on each node, and ensure that you have the read permission on the files. gs_ssh helps you quickly place files in the specified directory of each node.

    gs_ssh -c "gs_guc generate -o usermapping -S default -D $GAUSSHOME/bin"

  • If the -S parameter is set to default, a password is randomly generated. You can also specify a password for the -S parameter to ensure the security and uniqueness of the generated password file. You do not need to save or memorize the password. For details about other parameters, see the description of the gs_guc tool in the "Tool Reference".

Examples

-- Create a role.
gaussdb=# CREATE ROLE bob PASSWORD '********';

-- Create a foreign server.
gaussdb=# CREATE SERVER my_server FOREIGN DATA WRAPPER log_fdw;

-- Create a user mapping.
gaussdb=# CREATE USER MAPPING FOR bob SERVER my_server OPTIONS (user 'bob', password '********');

-- Modify the user mapping.
gaussdb=# ALTER USER MAPPING FOR bob SERVER my_server OPTIONS (SET password '********');

-- Delete the user mapping.
gaussdb=# DROP USER MAPPING FOR bob SERVER my_server;

-- Delete the foreign server.
gaussdb=# DROP SERVER my_server;

-- Delete the role.
gaussdb=# DROP ROLE bob;

Helpful Links

ALTER USER MAPPING and DROP USER MAPPING