ClickHouse/tests/config/config.d/enable_access_control_improvements.xml

<clickhouse>
    <access_control_improvements>
        <users_without_row_policies_can_read_rows>true</users_without_row_policies_can_read_rows>
        <on_cluster_queries_require_cluster_grant>true</on_cluster_queries_require_cluster_grant>
        <select_from_system_db_requires_grant>true</select_from_system_db_requires_grant>
        <select_from_information_schema_requires_grant>true</select_from_information_schema_requires_grant>
        <settings_constraints_replace_previous>true</settings_constraints_replace_previous>
        <table_engines_require_grant>true</table_engines_require_grant>
    </access_control_improvements>
</clickhouse>
Users without assigned row policies can view rows now. 2022-05-06 23:37:23 +00:00			`<clickhouse>`
			`<access_control_improvements>`
			`<users_without_row_policies_can_read_rows>true</users_without_row_policies_can_read_rows>`
Add separate CLUSTER grant In case you have different roles for the same user on multiple clusters, ON CLUSTER query can help to overcome some limitations. Consider the following example: - cluster_with_data, dev_user (readonly=2) - stage_cluster, dev_user (readonly=0) So when you will execute the following query from stage_cluster, it will be successfully executed, since ON CLUSTER queries has different system profile: DROP DATABASE default ON CLUSTER cluster_with_data This is not 100% safe, but at least something. Note, that right now only ON CLUSTER query it self is supported, but separate clusters are not (i.e. GRANT CLUSTER some_cluster_name TO default), since right now grants sticked to database+. v2: on_cluster_queries_require_cluster_grant v3: fix test and process flags as bit mask Signed-off-by: Azat Khuzhin <a.khuzhin@semrush.com> 2022-03-30 08:32:49 +00:00			`<on_cluster_queries_require_cluster_grant>true</on_cluster_queries_require_cluster_grant>`
Add option enabling that SELECT from the system database requires grant. 2022-07-07 17:17:07 +00:00			`<select_from_system_db_requires_grant>true</select_from_system_db_requires_grant>`
Correct the list of always accessible system tables. 2022-07-10 13:15:51 +00:00			`<select_from_information_schema_requires_grant>true</select_from_information_schema_requires_grant>`
work in progress 2022-09-02 02:12:05 +00:00			`<settings_constraints_replace_previous>true</settings_constraints_replace_previous>`
try enable grant of table engine in test 2024-03-14 01:31:45 +00:00			`<table_engines_require_grant>true</table_engines_require_grant>`
Users without assigned row policies can view rows now. 2022-05-06 23:37:23 +00:00			`</access_control_improvements>`
			`</clickhouse>`