Creating a Doris Permission Role

Updated on 2024-12-13 GMT+08:00

View PDF

The Doris permission management system implements row-level fine-grained permission control and role-based permission access control.

NOTE:

Only clusters of MRS 3.3.0 and later versions support role assignment on FusionInsight Manager. If the cluster is of MRS 3.3.0 or earlier, you need to connect to the database as user root (the default password is empty) regardless of whether Kerberos authentication is enabled.
In MRS 3.5.0 and later versions, if Kerberos authentication is disabled for the cluster (the cluster is in normal mode), you can also create a user on FusionInsight Manager and bind the user to a role to obtain the required permission.

Prerequisite

The Doris service is running properly.
The role name cannot be operator or admin.
When Kerberos authentication is enabled for the cluster (the cluster is in security mode), it takes about 2 minutes for the permission to take effect after the Doris permission is successfully assigned.

Adding the Doris Role

Log in to FusionInsight Manager and choose System > Permission > Role. On the displayed page, click Create Role.

Specify Role Name. In the Configure Resource Permission area, click the cluster name. On the displayed service list page, click the Doris service.

Determine whether to create a role with the Doris administrator rights based on service requirements.
NOTE:
- The Doris administrator has all the rights except the node operation rights.
- Role Name: The name of the role to be added cannot contain hyphens (-) and cannot start with a digit.
- If yes, go to 3.
- If no, go to 4.
Select Doris Admin Privilege and click OK.
Click Doris Read Write Privileges and select Select, Drop, Load, Alter, Create, or Grant for the corresponding resource.

Determine whether to grant the permission based on the service requirements.
After the authorization is complete, click OK.

Adding a User and Binding the User to the Doris Role

Log in to FusionInsight Managerr and choose System > Permission > User and click Create.
- Username: Enter the name of the user you want to create.
- User Type:
  - If Kerberos authentication is enabled for the cluster (the cluster is in security mode), select Human-Machine.
  - If Kerberos authentication is disabled for the cluster (the cluster is in normal mode), select Machine-Machine.
- Password and Confirm New Password: Enter a password for the human-machine user and enter it again.
- Role: Click Add. In the displayed dialog box, select a role with the Doris permission and click OK.
NOTE:
- Username: The username to be added cannot contain hyphens (-). Otherwise, the authentication fails.
- Password: The password cannot contain special characters $, ., and #. Otherwise, the authentication will fail.
Click OK.
Use the newly created user to connect to the Doris service.
- Kerberos authentication is enabled for the cluster (the cluster is in security mode)
  1. Log in to FusionInsight Manager as the new human-machine user and change the initial password.
  2. Log in to the node where the MySQL client is installed and use the new username and new password to connect to the Doris service.
    export LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1
    
    mysql -udorisuser -P -PConnection port for FE queries -hIP address of the Doris FE instance
    
    Enter the password for logging in to the database.
    NOTE:
    To obtain the query connection port of the Doris FE instance, you can log in to FusionInsight Manager, choose Cluster > Services > Doris > Configurations, and query the value of query_port of the Doris service.
    
    To obtain the IP address of the Doris FE instance, log in to FusionInsight Manager of the MRS cluster and choose Cluster > Services > Doris > Instances to view the service IP address of any FE instance.
    
    You can also use the MySQL connection software or Doris web UI to connect to the database.
- Kerberos authentication is disabled for the cluster (the cluster is in normal mode)
  1. Log in to the node where the MySQL client is installed and connect to the Doris service as user admin.
    mysql -uadmin-PConnection port for FE queries -hIP address of the Doris FE instance
    
    NOTE:
    
    The default password of user admin is empty.
  2. Set a password for the machine-machine user.
    SET PASSWORD FOR 'Machine-Machine Username' = PASSWORD('xxx')
  3. Connect to Doris on the MySQL client using the machine-machine user.
    mysql -uMachine-machine username -p-PConnection port for FE queries -hIP address of the Doris FE instance
    
    Enter the password of the user.

Adding a Role and Binding It to a User (Kerberos authentication is disabled for the cluster (the cluster is in normal mode))

This operation applies only to versions earlier than MRS 3.5.0.

Log in to the node where the MySQL client is installed and connect to the Doris service as user admin.

mysql -uadmin -PDatabase connection port -hIP address of Doris FE instance
NOTE:
- The default password of user admin is empty.
- The database connection port is the query connection port of the Doris FE. You can also log in to FusionInsight Manager, choose Cluster > Services > Doris > Configurations, and query the value of query_port of the Doris service.
- To obtain the IP address of the Doris FE instance, log in to FusionInsight Manager of the MRS cluster and choose Cluster > Services > Doris > Instances to view the IP address of any FE instance.
- You can also use the MySQL connection software or Doris WebUI to connect to the database.
Run the following command to create a role:

CREATE ROLE dorisrole;
Run the following command to grant permissions to the role. For details about the permissions, see About Doris User Permissions. For example, to grant the ADMIN_PRIV permission to the role, run the following command:

GRANT ADMIN_PRIV ON *.*.* TO ROLE 'dorisrole';
Create a user.
- Create a user and grant the user a role.
  CREATE USER 'dorisuser'@'%' IDENTIFIED BY 'password' DEFAULT ROLE 'dorisrole';
- Create a user, add a password expiration policy, and grant the user a role.
  For example, run the following commands to create the dorisuser user, set the user password to expire in 180 days, and grant the user the dorisrole:
  
  CREATE USER 'dorisuser'@'%' IDENTIFIED BY 'password' PASSWORD_EXPIRE INTERVAL 180 DAY;
  
  GRANT 'dorisrole' TO 'dorisuser'@'%';
  NOTE:
  - If Kerberos authentication is disabled for the cluster (the cluster is in normal mode), the user password never expires by default, which poses security risks. You are advised to set a password expiration policy to request the user to change the password periodically.
  - After the password expires, the user is unavailable. You must change the password as a user with the same level of rights as the Doris user.