mirror of
https://github.com/ClickHouse/ClickHouse.git
synced 2024-11-27 18:12:02 +00:00
153 lines
9.0 KiB
Markdown
153 lines
9.0 KiB
Markdown
---
|
||
slug: /en/operations/access-rights
|
||
sidebar_position: 48
|
||
sidebar_label: Access Control and Account Management
|
||
title: Access Control and Account Management
|
||
---
|
||
|
||
ClickHouse supports access control management based on [RBAC](https://en.wikipedia.org/wiki/Role-based_access_control) approach.
|
||
|
||
ClickHouse access entities:
|
||
- [User account](#user-account-management)
|
||
- [Role](#role-management)
|
||
- [Row Policy](#row-policy-management)
|
||
- [Settings Profile](#settings-profiles-management)
|
||
- [Quota](#quotas-management)
|
||
|
||
You can configure access entities using:
|
||
|
||
- SQL-driven workflow.
|
||
|
||
You need to [enable](#enabling-access-control) this functionality.
|
||
|
||
- Server [configuration files](../operations/configuration-files.md) `users.xml` and `config.xml`.
|
||
|
||
We recommend using SQL-driven workflow. Both of the configuration methods work simultaneously, so if you use the server configuration files for managing accounts and access rights, you can smoothly switch to SQL-driven workflow.
|
||
|
||
:::warning
|
||
You can’t manage the same access entity by both configuration methods simultaneously.
|
||
:::
|
||
|
||
To see all users, roles, profiles, etc. and all their grants use [SHOW ACCESS](../sql-reference/statements/show.md#show-access-statement) statement.
|
||
|
||
## Usage {#access-control-usage}
|
||
|
||
By default, the ClickHouse server provides the `default` user account which is not allowed using SQL-driven access control and account management but has all the rights and permissions. The `default` user account is used in any cases when the username is not defined, for example, at login from client or in distributed queries. In distributed query processing a default user account is used, if the configuration of the server or cluster does not specify the [user and password](../engines/table-engines/special/distributed.md) properties.
|
||
|
||
If you just started using ClickHouse, consider the following scenario:
|
||
|
||
1. [Enable](#enabling-access-control) SQL-driven access control and account management for the `default` user.
|
||
2. Log in to the `default` user account and create all the required users. Don’t forget to create an administrator account (`GRANT ALL ON *.* TO admin_user_account WITH GRANT OPTION`).
|
||
3. [Restrict permissions](../operations/settings/permissions-for-queries.md#permissions_for_queries) for the `default` user and disable SQL-driven access control and account management for it.
|
||
|
||
### Properties of Current Solution {#access-control-properties}
|
||
|
||
- You can grant permissions for databases and tables even if they do not exist.
|
||
- If a table was deleted, all the privileges that correspond to this table are not revoked. This means that even if you create a new table with the same name later, all the privileges remain valid. To revoke privileges corresponding to the deleted table, you need to execute, for example, the `REVOKE ALL PRIVILEGES ON db.table FROM ALL` query.
|
||
- There are no lifetime settings for privileges.
|
||
|
||
## User Account {#user-account-management}
|
||
|
||
A user account is an access entity that allows to authorize someone in ClickHouse. A user account contains:
|
||
|
||
- Identification information.
|
||
- [Privileges](../sql-reference/statements/grant.md#grant-privileges) that define a scope of queries the user can execute.
|
||
- Hosts allowed to connect to the ClickHouse server.
|
||
- Assigned and default roles.
|
||
- Settings with their constraints applied by default at user login.
|
||
- Assigned settings profiles.
|
||
|
||
Privileges can be granted to a user account by the [GRANT](../sql-reference/statements/grant.md) query or by assigning [roles](#role-management). To revoke privileges from a user, ClickHouse provides the [REVOKE](../sql-reference/statements/revoke.md) query. To list privileges for a user, use the [SHOW GRANTS](../sql-reference/statements/show.md#show-grants-statement) statement.
|
||
|
||
Management queries:
|
||
|
||
- [CREATE USER](../sql-reference/statements/create/user.md)
|
||
- [ALTER USER](../sql-reference/statements/alter/user.md#alter-user-statement)
|
||
- [DROP USER](../sql-reference/statements/drop.md)
|
||
- [SHOW CREATE USER](../sql-reference/statements/show.md#show-create-user-statement)
|
||
- [SHOW USERS](../sql-reference/statements/show.md#show-users-statement)
|
||
|
||
### Settings Applying {#access-control-settings-applying}
|
||
|
||
Settings can be configured differently: for a user account, in its granted roles and in settings profiles. At user login, if a setting is configured for different access entities, the value and constraints of this setting are applied as follows (from higher to lower priority):
|
||
|
||
1. User account settings.
|
||
2. The settings of default roles of the user account. If a setting is configured in some roles, then order of the setting application is undefined.
|
||
3. The settings from settings profiles assigned to a user or to its default roles. If a setting is configured in some profiles, then order of setting application is undefined.
|
||
4. Settings applied to all the server by default or from the [default profile](../operations/server-configuration-parameters/settings.md#default-profile).
|
||
|
||
## Role {#role-management}
|
||
|
||
Role is a container for access entities that can be granted to a user account.
|
||
|
||
Role contains:
|
||
|
||
- [Privileges](../sql-reference/statements/grant.md#grant-privileges)
|
||
- Settings and constraints
|
||
- List of assigned roles
|
||
|
||
Management queries:
|
||
|
||
- [CREATE ROLE](../sql-reference/statements/create/role.md)
|
||
- [ALTER ROLE](../sql-reference/statements/alter/role.md#alter-role-statement)
|
||
- [DROP ROLE](../sql-reference/statements/drop.md)
|
||
- [SET ROLE](../sql-reference/statements/set-role.md)
|
||
- [SET DEFAULT ROLE](../sql-reference/statements/set-role.md#set-default-role-statement)
|
||
- [SHOW CREATE ROLE](../sql-reference/statements/show.md#show-create-role-statement)
|
||
- [SHOW ROLES](../sql-reference/statements/show.md#show-roles-statement)
|
||
|
||
Privileges can be granted to a role by the [GRANT](../sql-reference/statements/grant.md) query. To revoke privileges from a role ClickHouse provides the [REVOKE](../sql-reference/statements/revoke.md) query.
|
||
|
||
## Row Policy {#row-policy-management}
|
||
|
||
Row policy is a filter that defines which of the rows are available to a user or a role. Row policy contains filters for one particular table, as well as a list of roles and/or users which should use this row policy.
|
||
|
||
:::warning
|
||
Row policies makes sense only for users with readonly access. If user can modify table or copy partitions between tables, it defeats the restrictions of row policies.
|
||
:::
|
||
|
||
Management queries:
|
||
|
||
- [CREATE ROW POLICY](../sql-reference/statements/create/row-policy.md)
|
||
- [ALTER ROW POLICY](../sql-reference/statements/alter/row-policy.md#alter-row-policy-statement)
|
||
- [DROP ROW POLICY](../sql-reference/statements/drop.md#drop-row-policy-statement)
|
||
- [SHOW CREATE ROW POLICY](../sql-reference/statements/show.md#show-create-row-policy-statement)
|
||
- [SHOW POLICIES](../sql-reference/statements/show.md#show-policies-statement)
|
||
|
||
## Settings Profile {#settings-profiles-management}
|
||
|
||
Settings profile is a collection of [settings](../operations/settings/index.md). Settings profile contains settings and constraints, as well as a list of roles and/or users to which this profile is applied.
|
||
|
||
Management queries:
|
||
|
||
- [CREATE SETTINGS PROFILE](../sql-reference/statements/create/settings-profile.md#create-settings-profile-statement)
|
||
- [ALTER SETTINGS PROFILE](../sql-reference/statements/alter/settings-profile.md#alter-settings-profile-statement)
|
||
- [DROP SETTINGS PROFILE](../sql-reference/statements/drop.md#drop-settings-profile-statement)
|
||
- [SHOW CREATE SETTINGS PROFILE](../sql-reference/statements/show.md#show-create-settings-profile-statement)
|
||
- [SHOW PROFILES](../sql-reference/statements/show.md#show-profiles-statement)
|
||
|
||
## Quota {#quotas-management}
|
||
|
||
Quota limits resource usage. See [Quotas](../operations/quotas.md).
|
||
|
||
Quota contains a set of limits for some durations, as well as a list of roles and/or users which should use this quota.
|
||
|
||
Management queries:
|
||
|
||
- [CREATE QUOTA](../sql-reference/statements/create/quota.md)
|
||
- [ALTER QUOTA](../sql-reference/statements/alter/quota.md#alter-quota-statement)
|
||
- [DROP QUOTA](../sql-reference/statements/drop.md#drop-quota-statement)
|
||
- [SHOW CREATE QUOTA](../sql-reference/statements/show.md#show-create-quota-statement)
|
||
- [SHOW QUOTA](../sql-reference/statements/show.md#show-quota-statement)
|
||
- [SHOW QUOTAS](../sql-reference/statements/show.md#show-quotas-statement)
|
||
|
||
## Enabling SQL-driven Access Control and Account Management {#enabling-access-control}
|
||
|
||
- Setup a directory for configurations storage.
|
||
|
||
ClickHouse stores access entity configurations in the folder set in the [access_control_path](../operations/server-configuration-parameters/settings.md#access_control_path) server configuration parameter.
|
||
|
||
- Enable SQL-driven access control and account management for at least one user account.
|
||
|
||
By default, SQL-driven access control and account management is disabled for all users. You need to configure at least one user in the `users.xml` configuration file and set the value of the [access_management](../operations/settings/settings-users.md#access_management-user-setting) setting to 1.
|