| import{_ as d,C as a,O as o,P as u,ah as c,Q as e,U as t,ai as s,ae as i,aW as n}from"./framework-e4340ccd.js";const g={},m=e("h1",{id:"administration-management",tabindex:"-1"},[e("a",{class:"header-anchor",href:"#administration-management","aria-hidden":"true"},"#"),t(" Administration Management")],-1),v=e("p",null,"IoTDB provides users with account privilege management operations, so as to ensure data security.",-1),E=n('<h2 id="basic-concepts" tabindex="-1"><a class="header-anchor" href="#basic-concepts" aria-hidden="true">#</a> Basic Concepts</h2><h3 id="user" tabindex="-1"><a class="header-anchor" href="#user" aria-hidden="true">#</a> User</h3><p>The user is the legal user of the database. A user corresponds to a unique username and has a password as a means of authentication. Before using a database, a person must first provide a legitimate username and password to make himself/herself a user.</p><h3 id="privilege" tabindex="-1"><a class="header-anchor" href="#privilege" aria-hidden="true">#</a> Privilege</h3>',4),h=n('<h3 id="role" tabindex="-1"><a class="header-anchor" href="#role" aria-hidden="true">#</a> Role</h3><p>A role is a set of privileges and has a unique role name as an identifier. A user usually corresponds to a real identity (such as a traffic dispatcher), while a real identity may correspond to multiple users. These users with the same real identity tend to have the same privileges. Roles are abstractions that can unify the management of such privileges.</p><h3 id="default-user" tabindex="-1"><a class="header-anchor" href="#default-user" aria-hidden="true">#</a> Default User</h3><p>There is a default user in IoTDB after the initial installation: root, and the default password is root. This user is an administrator user, who cannot be deleted and has all the privileges. Neither can new privileges be granted to the root user nor can privileges owned by the root user be deleted.</p><h2 id="privilege-management-operation-examples" tabindex="-1"><a class="header-anchor" href="#privilege-management-operation-examples" aria-hidden="true">#</a> Privilege Management Operation Examples</h2>',5),p={href:"https://github.com/thulab/iotdb/files/4438687/OtherMaterial-Sample.Data.txt",target:"_blank",rel:"noopener noreferrer"},b=n(`<h3 id="create-user" tabindex="-1"><a class="header-anchor" href="#create-user" aria-hidden="true">#</a> Create User</h3><p>We use <code>CREATE USER <userName> <password></code> to create users. For example, we can use root user who has all privileges to create two users for ln and sgcc groups, named ln_write_user and sgcc_write_user, with both passwords being write_pwd. It is recommended to wrap the username in backtick(\`). The SQL statement is:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>CREATE USER \`ln_write_user\` 'write_pwd' | |
| CREATE USER \`sgcc_write_user\` 'write_pwd' | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><p>Then use the following SQL statement to show the user:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST USER | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><p>As can be seen from the result shown below, the two users have been created:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>IoTDB> CREATE USER \`ln_write_user\` 'write_pwd' | |
| Msg: The statement is executed successfully. | |
| IoTDB> CREATE USER \`sgcc_write_user\` 'write_pwd' | |
| Msg: The statement is executed successfully. | |
| IoTDB> LIST USER | |
| +---------------+ | |
| | user| | |
| +---------------+ | |
| | ln_write_user| | |
| | root| | |
| |sgcc_write_user| | |
| +---------------+ | |
| Total line number = 3 | |
| It costs 0.157s | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><h3 id="grant-user-privilege" tabindex="-1"><a class="header-anchor" href="#grant-user-privilege" aria-hidden="true">#</a> Grant User Privilege</h3><p>At this point, although two users have been created, they do not have any privileges, so they can not operate on the database. For example, we use ln_write_user to write data in the database, the SQL statement is:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true) | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><p>The SQL statement will not be executed and the corresponding error prompt is given as follows:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>IoTDB> INSERT INTO root.ln.wf01.wt01(timestamp,status) values(1509465600000,true) | |
| Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES. | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><p>Now, we use root user to grant the two users write privileges to the corresponding databases.</p><p>We use <code>GRANT USER <userName> PRIVILEGES <privileges> ON <nodeName></code> to grant user privileges(ps: grant create user does not need path). For example:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>GRANT USER \`ln_write_user\` PRIVILEGES INSERT_TIMESERIES on root.ln.** | |
| GRANT USER \`sgcc_write_user\` PRIVILEGES INSERT_TIMESERIES on root.sgcc1.**, root.sgcc2.** | |
| GRANT USER \`ln_write_user\` PRIVILEGES CREATE_USER | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><p>The execution result is as follows:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>IoTDB> GRANT USER \`ln_write_user\` PRIVILEGES INSERT_TIMESERIES on root.ln.** | |
| Msg: The statement is executed successfully. | |
| IoTDB> GRANT USER \`sgcc_write_user\` PRIVILEGES INSERT_TIMESERIES on root.sgcc1.**, root.sgcc2.** | |
| Msg: The statement is executed successfully. | |
| IoTDB> GRANT USER \`ln_write_user\` PRIVILEGES CREATE_USER | |
| Msg: The statement is executed successfully. | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><p>Next, use ln_write_user to try to write data again.</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>IoTDB> INSERT INTO root.ln.wf01.wt01(timestamp, status) values(1509465600000, true) | |
| Msg: The statement is executed successfully. | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><h3 id="revoker-user-privilege" tabindex="-1"><a class="header-anchor" href="#revoker-user-privilege" aria-hidden="true">#</a> Revoker User Privilege</h3><p>After granting user privileges, we could use <code>REVOKE USER <userName> PRIVILEGES <privileges> ON <nodeName></code> to revoke the granted user privileges(ps: revoke create user does not need path). For example, use root user to revoke the privilege of ln_write_user and sgcc_write_user:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>REVOKE USER \`ln_write_user\` PRIVILEGES INSERT_TIMESERIES on root.ln.** | |
| REVOKE USER \`sgcc_write_user\` PRIVILEGES INSERT_TIMESERIES on root.sgcc1.**, root.sgcc2.** | |
| REVOKE USER \`ln_write_user\` PRIVILEGES CREATE_USER | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><p>The execution result is as follows:</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>REVOKE USER \`ln_write_user\` PRIVILEGES INSERT_TIMESERIES on root.ln.** | |
| Msg: The statement is executed successfully. | |
| REVOKE USER \`sgcc_write_user\` PRIVILEGES INSERT_TIMESERIES on root.sgcc1.**, root.sgcc2.** | |
| Msg: The statement is executed successfully. | |
| REVOKE USER \`ln_write_user\` PRIVILEGES CREATE_USER | |
| Msg: The statement is executed successfully. | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><p>After revoking, ln_write_user has no permission to writing data to root.ln.**</p><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>INSERT INTO root.ln.wf01.wt01(timestamp, status) values(1509465600000, true) | |
| Msg: 602: No permissions for this operation, please add privilege INSERT_TIMESERIES. | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><h3 id="sql-statements" tabindex="-1"><a class="header-anchor" href="#sql-statements" aria-hidden="true">#</a> SQL Statements</h3><p>Here are all related SQL statements:</p><ul><li>Create User</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>CREATE USER <userName> <password>; | |
| Eg: IoTDB > CREATE USER \`thulab\` 'pwd'; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Delete User</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>DROP USER <userName>; | |
| Eg: IoTDB > DROP USER \`xiaoming\`; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Create Role</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>CREATE ROLE <roleName>; | |
| Eg: IoTDB > CREATE ROLE \`admin\`; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Delete Role</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>DROP ROLE <roleName>; | |
| Eg: IoTDB > DROP ROLE \`admin\`; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Grant User Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>GRANT USER <userName> PRIVILEGES <privileges> ON <nodeNames>; | |
| Eg: IoTDB > GRANT USER \`tempuser\` PRIVILEGES INSERT_TIMESERIES, DELETE_TIMESERIES on root.ln.**, root.sgcc.**; | |
| Eg: IoTDB > GRANT USER \`tempuser\` PRIVILEGES CREATE_ROLE; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Grant User All Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>GRANT USER <userName> PRIVILEGES ALL; | |
| Eg: IoTDB > GRANT USER \`tempuser\` PRIVILEGES ALL; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Grant Role Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>GRANT ROLE <roleName> PRIVILEGES <privileges> ON <nodeNames>; | |
| Eg: IoTDB > GRANT ROLE \`temprole\` PRIVILEGES INSERT_TIMESERIES, DELETE_TIMESERIES ON root.sgcc.**, root.ln.**; | |
| Eg: IoTDB > GRANT ROLE \`temprole\` PRIVILEGES CREATE_ROLE; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Grant Role All Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>GRANT ROLE <roleName> PRIVILEGES ALL ON <nodeNames>; | |
| Eg: IoTDB > GRANT ROLE \`temprole\` PRIVILEGES ALL; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Grant User Role</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>GRANT <roleName> TO <userName>; | |
| Eg: IoTDB > GRANT \`temprole\` TO tempuser; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Revoke User Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>REVOKE USER <userName> PRIVILEGES <privileges> ON <nodeNames>; | |
| Eg: IoTDB > REVOKE USER \`tempuser\` PRIVILEGES DELETE_TIMESERIES on root.ln.**; | |
| Eg: IoTDB > REVOKE USER \`tempuser\` PRIVILEGES CREATE_ROLE; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Revoke User All Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>REVOKE USER <userName> PRIVILEGES ALL; | |
| Eg: IoTDB > REVOKE USER \`tempuser\` PRIVILEGES ALL; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Revoke Role Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>REVOKE ROLE <roleName> PRIVILEGES <privileges> ON <nodeNames>; | |
| Eg: IoTDB > REVOKE ROLE \`temprole\` PRIVILEGES DELETE_TIMESERIES ON root.ln.**; | |
| Eg: IoTDB > REVOKE ROLE \`temprole\` PRIVILEGES CREATE_ROLE; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Revoke All Role Privileges</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>REVOKE ROLE <roleName> PRIVILEGES ALL; | |
| Eg: IoTDB > REVOKE ROLE \`temprole\` PRIVILEGES ALL; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Revoke Role From User</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>REVOKE <roleName> FROM <userName>; | |
| Eg: IoTDB > REVOKE \`temprole\` FROM tempuser; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List Users</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST USER | |
| Eg: IoTDB > LIST USER | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List User of Specific Role</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST USER OF ROLE <roleName>; | |
| Eg: IoTDB > LIST USER OF ROLE \`roleuser\`; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List Roles</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST ROLE | |
| Eg: IoTDB > LIST ROLE | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List Roles of Specific User</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST ROLE OF USER <username> ; | |
| Eg: IoTDB > LIST ROLE OF USER \`tempuser\`; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List All Privileges of Users</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST PRIVILEGES USER <username> ; | |
| Eg: IoTDB > LIST PRIVILEGES USER \`tempuser\`; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List Related Privileges of Users(On Specific Paths)</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST PRIVILEGES USER <username> ON <paths>; | |
| Eg: IoTDB> LIST PRIVILEGES USER \`tempuser\` ON root.ln.**, root.ln.wf01.**; | |
| +--------+-----------------------------------+ | |
| | role| privilege| | |
| +--------+-----------------------------------+ | |
| | | root.ln.** : ALTER_TIMESERIES| | |
| |temprole|root.ln.wf01.** : CREATE_TIMESERIES| | |
| +--------+-----------------------------------+ | |
| Total line number = 2 | |
| It costs 0.005s | |
| IoTDB> LIST PRIVILEGES USER \`tempuser\` ON root.ln.wf01.wt01.**; | |
| +--------+-----------------------------------+ | |
| | role| privilege| | |
| +--------+-----------------------------------+ | |
| | | root.ln.** : ALTER_TIMESERIES| | |
| |temprole|root.ln.wf01.** : CREATE_TIMESERIES| | |
| +--------+-----------------------------------+ | |
| Total line number = 2 | |
| It costs 0.005s | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List All Privileges of Roles</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST PRIVILEGES ROLE <roleName> | |
| Eg: IoTDB > LIST PRIVILEGES ROLE \`actor\`; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>List Related Privileges of Roles(On Specific Paths)</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>LIST PRIVILEGES ROLE <roleName> ON <paths>; | |
| Eg: IoTDB> LIST PRIVILEGES ROLE \`temprole\` ON root.ln.**, root.ln.wf01.wt01.**; | |
| +-----------------------------------+ | |
| | privilege| | |
| +-----------------------------------+ | |
| |root.ln.wf01.** : CREATE_TIMESERIES| | |
| +-----------------------------------+ | |
| Total line number = 1 | |
| It costs 0.005s | |
| IoTDB> LIST PRIVILEGES ROLE \`temprole\` ON root.ln.wf01.wt01.**; | |
| +-----------------------------------+ | |
| | privilege| | |
| +-----------------------------------+ | |
| |root.ln.wf01.** : CREATE_TIMESERIES| | |
| +-----------------------------------+ | |
| Total line number = 1 | |
| It costs 0.005s | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>Alter Password</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>ALTER USER <username> SET PASSWORD <password>; | |
| Eg: IoTDB > ALTER USER \`tempuser\` SET PASSWORD 'newpwd'; | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><h2 id="other-instructions" tabindex="-1"><a class="header-anchor" href="#other-instructions" aria-hidden="true">#</a> Other Instructions</h2><h3 id="the-relationship-among-users-privileges-and-roles" tabindex="-1"><a class="header-anchor" href="#the-relationship-among-users-privileges-and-roles" aria-hidden="true">#</a> The Relationship among Users, Privileges and Roles</h3><p>A Role is a set of privileges, and privileges and roles are both attributes of users. That is, a role can have several privileges and a user can have several roles and privileges (called the user's own privileges).</p><p>At present, there is no conflicting privilege in IoTDB, so the real privileges of a user is the union of the user's own privileges and the privileges of the user's roles. That is to say, to determine whether a user can perform an operation, it depends on whether one of the user's own privileges or the privileges of the user's roles permits the operation. The user's own privileges and privileges of the user's roles may overlap, but it does not matter.</p><p>It should be noted that if users have a privilege (corresponding to operation A) themselves and their roles contain the same privilege, then revoking the privilege from the users themselves alone can not prohibit the users from performing operation A, since it is necessary to revoke the privilege from the role, or revoke the role from the user. Similarly, revoking the privilege from the users's roles alone can not prohibit the users from performing operation A.</p><p>At the same time, changes to roles are immediately reflected on all users who own the roles. For example, adding certain privileges to roles will immediately give all users who own the roles corresponding privileges, and deleting certain privileges will also deprive the corresponding users of the privileges (unless the users themselves have the privileges).</p><h3 id="list-of-privileges-included-in-the-system" tabindex="-1"><a class="header-anchor" href="#list-of-privileges-included-in-the-system" aria-hidden="true">#</a> List of Privileges Included in the System</h3><p><strong>List of privileges Included in the System</strong></p>`,82),R=e("thead",null,[e("tr",null,[e("th",{style:{"text-align":"left"}},"privilege Name"),e("th",{style:{"text-align":"left"}},"Interpretation"),e("th",null,"Example")])],-1),I=e("tr",null,[e("td",{style:{"text-align":"left"}},"CREATE_DATABASE"),e("td",{style:{"text-align":"left"}},"create database; set/unset database ttl; path dependent"),e("td",null,[t("Eg1: "),e("code",null,"CREATE DATABASE root.ln;"),e("br"),t("Eg2:"),e("code",null,"set ttl to root.ln 3600000;"),e("br"),t("Eg3:"),e("code",null,"unset ttl to root.ln;")])],-1),x=e("tr",null,[e("td",{style:{"text-align":"left"}},"DELETE_DATABASE"),e("td",{style:{"text-align":"left"}},"delete databases; path dependent"),e("td",null,[t("Eg: "),e("code",null,"delete database root.ln;")])],-1),T=e("tr",null,[e("td",{style:{"text-align":"left"}},"CREATE_TIMESERIES"),e("td",{style:{"text-align":"left"}},"create timeseries; path dependent"),e("td",null,[t("Eg1: create timeseries"),e("br"),e("code",null,"create timeseries root.ln.wf02.status with datatype=BOOLEAN,encoding=PLAIN;"),e("br"),t("Eg2: create aligned timeseries"),e("br"),e("code",null,"create aligned timeseries root.ln.device1(latitude FLOAT encoding=PLAIN compressor=SNAPPY, longitude FLOAT encoding=PLAIN compressor=SNAPPY);")])],-1),S=e("tr",null,[e("td",{style:{"text-align":"left"}},"INSERT_TIMESERIES"),e("td",{style:{"text-align":"left"}},"insert data; path dependent"),e("td",null,[t("Eg1: "),e("code",null,"insert into root.ln.wf02(timestamp,status) values(1,true);"),e("br"),t("Eg2: "),e("code",null,"insert into root.sg1.d1(time, s1, s2) aligned values(1, 1, 1)")])],-1),_=e("tr",null,[e("td",{style:{"text-align":"left"}},"ALTER_TIMESERIES"),e("td",{style:{"text-align":"left"}},"alter timeseries; path dependent"),e("td",null,[t("Eg1: "),e("code",null,"alter timeseries root.turbine.d1.s1 ADD TAGS tag3=v3, tag4=v4;"),e("br"),t("Eg2: "),e("code",null,"ALTER timeseries root.turbine.d1.s1 UPSERT ALIAS=newAlias TAGS(tag2=newV2, tag3=v3) ATTRIBUTES(attr3=v3, attr4=v4);")])],-1),f=e("td",{style:{"text-align":"left"}},"READ_TIMESERIES",-1),L=e("td",{style:{"text-align":"left"}},"query data; path dependent",-1),w=e("code",null,"SHOW DATABASES;",-1),A=e("br",null,null,-1),N=e("code",null,"show child paths root.ln, show child nodes root.ln;",-1),O=e("br",null,null,-1),y=e("code",null,"show devices;",-1),D=e("br",null,null,-1),U=e("code",null,"show timeseries root.**;",-1),P=e("br",null,null,-1),G=e("code",null,"show schema templates;",-1),B=e("br",null,null,-1),M=e("code",null,"show all ttl",-1),V=e("br",null,null,-1),C=e("br",null,null,-1),k=e("br",null,null,-1),F=e("code",null,"./export-csv.bat -h 127.0.0.1 -p 6667 -u tempuser -pw root -td ./",-1),Q=e("br",null,null,-1),q=e("br",null,null,-1),K=e("code",null,"tracing select * from root.**",-1),W=e("br",null,null,-1),Y=e("br",null,null,-1),H=e("code",null,"select example(*) from root.sg.d1",-1),J=e("br",null,null,-1),j=e("br",null,null,-1),z=e("code",null,"show triggers",-1),X=e("br",null,null,-1),Z=e("br",null,null,-1),$=e("code",null,"count devices",-1),ee=e("tr",null,[e("td",{style:{"text-align":"left"}},"DELETE_TIMESERIES"),e("td",{style:{"text-align":"left"}},"delete data or timeseries; path dependent"),e("td",null,[t("Eg1: delete timeseries"),e("br"),e("code",null,"delete timeseries root.ln.wf01.wt01.status"),e("br"),t("Eg2: delete data"),e("br"),e("code",null,"delete from root.ln.wf02.wt02.status where time < 10"),e("br"),t("Eg3: use drop semantic"),e("br"),t("`drop timeseries root.ln.wf01.wt01.status")])],-1),te=e("tr",null,[e("td",{style:{"text-align":"left"}},"CREATE_USER"),e("td",{style:{"text-align":"left"}},"create users; path independent"),e("td",null,[t("Eg: "),e("code",null,"create user thulab 'passwd';")])],-1),se=e("tr",null,[e("td",{style:{"text-align":"left"}},"DELETE_USER"),e("td",{style:{"text-align":"left"}},"delete users; path independent"),e("td",null,[t("Eg: "),e("code",null,"drop user xiaoming;")])],-1),le=e("tr",null,[e("td",{style:{"text-align":"left"}},"MODIFY_PASSWORD"),e("td",{style:{"text-align":"left"}},"modify passwords for all users; path independent; (Those who do not have this privilege can still change their own asswords. )"),e("td",null,[t("Eg: "),e("code",null,"alter user tempuser SET PASSWORD 'newpwd';")])],-1),ie=e("tr",null,[e("td",{style:{"text-align":"left"}},"LIST_USER"),e("td",{style:{"text-align":"left"}},"list all users; list all user of specific role; list a user's related privileges on speciific paths; path independent"),e("td",null,[t("Eg1: "),e("code",null,"list user;"),e("br"),t("Eg2: "),e("code",null,"list user of role 'wirte_role';"),e("br"),t("Eg3: "),e("code",null,"list privileges user admin;"),e("br"),t("Eg4: "),e("code",null,"list privileges user 'admin' on root.sgcc.**;")])],-1),ne=e("tr",null,[e("td",{style:{"text-align":"left"}},"GRANT_USER_PRIVILEGE"),e("td",{style:{"text-align":"left"}},"grant user privileges; path independent"),e("td",null,[t("Eg: "),e("code",null,"grant user tempuser privileges DELETE_TIMESERIES on root.ln.**;")])],-1),ae=e("tr",null,[e("td",{style:{"text-align":"left"}},"REVOKE_USER_PRIVILEGE"),e("td",{style:{"text-align":"left"}},"revoke user privileges; path independent"),e("td",null,[t("Eg: "),e("code",null,"revoke user tempuser privileges DELETE_TIMESERIES on root.ln.**;")])],-1),re=e("tr",null,[e("td",{style:{"text-align":"left"}},"GRANT_USER_ROLE"),e("td",{style:{"text-align":"left"}},"grant user roles; path independent"),e("td",null,[t("Eg: "),e("code",null,"grant temprole to tempuser;")])],-1),de=e("tr",null,[e("td",{style:{"text-align":"left"}},"REVOKE_USER_ROLE"),e("td",{style:{"text-align":"left"}},"revoke user roles; path independent"),e("td",null,[t("Eg: "),e("code",null,"revoke temprole from tempuser;")])],-1),oe=e("tr",null,[e("td",{style:{"text-align":"left"}},"CREATE_ROLE"),e("td",{style:{"text-align":"left"}},"create roles; path independent"),e("td",null,[t("Eg: "),e("code",null,"create role admin;")])],-1),ue=e("tr",null,[e("td",{style:{"text-align":"left"}},"DELETE_ROLE"),e("td",{style:{"text-align":"left"}},"delete roles; path independent"),e("td",null,[t("Eg: "),e("code",null,"drop role admin;")])],-1),ce=e("tr",null,[e("td",{style:{"text-align":"left"}},"LIST_ROLE"),e("td",{style:{"text-align":"left"}},"list all roles; list all roles of specific user; list a role's related privileges on speciific paths; path independent"),e("td",null,[t("Eg1: "),e("code",null,"list role"),e("br"),t("Eg2: "),e("code",null,"list role of user 'actor';"),e("br"),t("Eg3: "),e("code",null,"list privileges role wirte_role;"),e("br"),t("Eg4: "),e("code",null,"list privileges role wirte_role ON root.sgcc;")])],-1),ge=e("tr",null,[e("td",{style:{"text-align":"left"}},"GRANT_ROLE_PRIVILEGE"),e("td",{style:{"text-align":"left"}},"grant role privileges; path independent"),e("td",null,[t("Eg: "),e("code",null,"grant role temprole privileges DELETE_TIMESERIES ON root.ln.**;")])],-1),me=e("tr",null,[e("td",{style:{"text-align":"left"}},"REVOKE_ROLE_PRIVILEGE"),e("td",{style:{"text-align":"left"}},"revoke role privileges; path independent"),e("td",null,[t("Eg: "),e("code",null,"revoke role temprole privileges DELETE_TIMESERIES ON root.ln.**;")])],-1),ve=e("tr",null,[e("td",{style:{"text-align":"left"}},"CREATE_FUNCTION"),e("td",{style:{"text-align":"left"}},"register UDFs; path independent"),e("td",null,[t("Eg: "),e("code",null,"create function example AS 'org.apache.iotdb.udf.UDTFExample';")])],-1),Ee=e("tr",null,[e("td",{style:{"text-align":"left"}},"DROP_FUNCTION"),e("td",{style:{"text-align":"left"}},"deregister UDFs; path independent"),e("td",null,[t("Eg: "),e("code",null,"drop function example")])],-1),he=e("tr",null,[e("td",{style:{"text-align":"left"}},"CREATE_TRIGGER"),e("td",{style:{"text-align":"left"}},"create triggers; path dependent"),e("td",null,[t("Eg1: "),e("code",null,"CREATE TRIGGER <TRIGGER-NAME> BEFORE INSERT ON <FULL-PATH> AS <CLASSNAME>"),e("br"),t("Eg2: "),e("code",null,"CREATE TRIGGER <TRIGGER-NAME> AFTER INSERT ON <FULL-PATH> AS <CLASSNAME>")])],-1),pe=e("tr",null,[e("td",{style:{"text-align":"left"}},"DROP_TRIGGER"),e("td",{style:{"text-align":"left"}},"drop triggers; path dependent"),e("td",null,[t("Eg: "),e("code",null,"drop trigger 'alert-listener-sg1d1s1'")])],-1),be=e("tr",null,[e("td",{style:{"text-align":"left"}},"CREATE_CONTINUOUS_QUERY"),e("td",{style:{"text-align":"left"}},"create continuous queries; path independent"),e("td",null,[t("Eg: "),e("code",null,"CREATE CONTINUOUS QUERY cq1 RESAMPLE RANGE 40s BEGIN <QUERY-BODY> END")])],-1),Re=e("tr",null,[e("td",{style:{"text-align":"left"}},"DROP_CONTINUOUS_QUERY"),e("td",{style:{"text-align":"left"}},"drop continuous queries; path independent"),e("td",null,[t("Eg1: "),e("code",null,"DROP CONTINUOUS QUERY cq3"),e("br"),t("Eg2: "),e("code",null,"DROP CQ cq3")])],-1),Ie=e("tr",null,[e("td",{style:{"text-align":"left"}},"SHOW_CONTINUOUS_QUERIES"),e("td",{style:{"text-align":"left"}},"show continuous queries; path independent"),e("td",null,[t("Eg1: "),e("code",null,"SHOW CONTINUOUS QUERIES"),e("br"),t("Eg2: "),e("code",null,"SHOW cqs")])],-1),xe=e("tr",null,[e("td",{style:{"text-align":"left"}},"UPDATE_TEMPLATE"),e("td",{style:{"text-align":"left"}},"create and drop schema template; path independent"),e("td",null,[t("Eg1: "),e("code",null,"create schema template t1(s1 int32)"),e("br"),t("Eg2: "),e("code",null,"drop schema template t1")])],-1),Te=e("tr",null,[e("td",{style:{"text-align":"left"}},"READ_TEMPLATE"),e("td",{style:{"text-align":"left"}},"show schema templates and show nodes in schema template; path independent"),e("td",null,[t("Eg1: "),e("code",null,"show schema templates"),e("br"),t("Eg2: "),e("code",null,"show nodes in template t1")])],-1),Se=e("tr",null,[e("td",{style:{"text-align":"left"}},"APPLY_TEMPLATE"),e("td",{style:{"text-align":"left"}},"set, unset and activate schema template; path dependent"),e("td",null,[t("Eg1: "),e("code",null,"set schema template t1 to root.sg.d"),e("br"),t("Eg2: "),e("code",null,"unset schema template t1 from root.sg.d"),e("br"),t("Eg3: "),e("code",null,"create timeseries of schema template on root.sg.d"),e("br"),t("Eg4: "),e("code",null,"delete timeseries of schema template on root.sg.d")])],-1),_e=e("tr",null,[e("td",{style:{"text-align":"left"}},"READ_TEMPLATE_APPLICATION"),e("td",{style:{"text-align":"left"}},"show paths set and using schema template; path independent"),e("td",null,[t("Eg1: "),e("code",null,"show paths set schema template t1"),e("br"),t("Eg2: "),e("code",null,"show paths using schema template t1")])],-1),fe=n(`<p>Note that path dependent privileges can only be granted or revoked on root.**;</p><p>Note that the following SQL statements need to be granted multiple permissions before they can be used：</p><ul><li>Import data: Need to assign <code>READ_TIMESERIES</code>，<code>INSERT_TIMESERIES</code> two permissions.。</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > ./import-csv.bat -h 127.0.0.1 -p 6667 -u renyuhua -pw root -f dump0.csv | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>Query Write-back (SELECT INTO)</li><li><ul><li><code>READ_TIMESERIES</code> permission of source sequence in all <code>select</code> clauses is required</li><li><code>INSERT_TIMESERIES</code> permission of target sequence in all <code>into</code> clauses is required</li></ul></li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > select s1, s1 into t1, t2 from root.sg.d1 limit 5 offset 1000 | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><h3 id="username-restrictions" tabindex="-1"><a class="header-anchor" href="#username-restrictions" aria-hidden="true">#</a> Username Restrictions</h3><p>IoTDB specifies that the character length of a username should not be less than 4, and the username cannot contain spaces.</p><h3 id="password-restrictions" tabindex="-1"><a class="header-anchor" href="#password-restrictions" aria-hidden="true">#</a> Password Restrictions</h3><p>IoTDB specifies that the character length of a password should have no less than 4 character length, and no spaces. The password is encrypted with MD5.</p><h3 id="role-name-restrictions" tabindex="-1"><a class="header-anchor" href="#role-name-restrictions" aria-hidden="true">#</a> Role Name Restrictions</h3><p>IoTDB specifies that the character length of a role name should have no less than 4 character length, and no spaces.</p><h3 id="path-pattern-in-administration-management" tabindex="-1"><a class="header-anchor" href="#path-pattern-in-administration-management" aria-hidden="true">#</a> Path pattern in Administration Management</h3><p>A path pattern's result set contains all the elements of its sub pattern's result set. For example, <code>root.sg.d.*</code> is a sub pattern of <code>root.sg.*.*</code>, while <code>root.sg.**</code> is not a sub pattern of <code>root.sg.*.*</code>. When a user is granted privilege on a pattern, the pattern used in his DDL or DML must be a sub pattern of the privilege pattern, which guarantees that the user won't access the timeseries exceed his privilege scope.</p><h3 id="permission-cache" tabindex="-1"><a class="header-anchor" href="#permission-cache" aria-hidden="true">#</a> Permission cache</h3><p>In distributed related permission operations, when changing permissions other than creating users and roles, all the cache information of <code>dataNode</code> related to the user (role) will be cleared first. If any <code>dataNode</code> cache information is clear and fails, the permission change task will fail.</p><h3 id="operations-restricted-by-non-root-users" tabindex="-1"><a class="header-anchor" href="#operations-restricted-by-non-root-users" aria-hidden="true">#</a> Operations restricted by non root users</h3><p>At present, the following SQL statements supported by iotdb can only be operated by the <code>root</code> user, and no corresponding permission can be given to the new user.</p><h6 id="tsfile-management" tabindex="-1"><a class="header-anchor" href="#tsfile-management" aria-hidden="true">#</a> TsFile Management</h6><ul><li>Load TsFiles</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > load '/Users/Desktop/data/1575028885956-101-0.tsfile' | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>remove a tsfile</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > remove '/Users/Desktop/data/data/root.vehicle/0/0/1575028885956-101-0.tsfile' | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>unload a tsfile and move it to a target directory</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > unload '/Users/Desktop/data/data/root.vehicle/0/0/1575028885956-101-0.tsfile' '/data/data/tmp' | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><h6 id="delete-time-partition-experimental" tabindex="-1"><a class="header-anchor" href="#delete-time-partition-experimental" aria-hidden="true">#</a> Delete Time Partition (experimental)</h6><ul><li>Delete Time Partition (experimental)</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > DELETE PARTITION root.ln 0,1,2 | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><h6 id="continuous-query-cq" tabindex="-1"><a class="header-anchor" href="#continuous-query-cq" aria-hidden="true">#</a> Continuous Query,CQ</h6><ul><li>Continuous Query,CQ</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > CREATE CONTINUOUS QUERY cq1 BEGIN SELECT max_value(temperature) INTO temperature_max FROM root.ln.*.* GROUP BY time(10s) END | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><h6 id="maintenance-command" tabindex="-1"><a class="header-anchor" href="#maintenance-command" aria-hidden="true">#</a> Maintenance Command</h6><ul><li>FLUSH</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > flush | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>MERGE</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > MERGE | |
| Eg: IoTDB > FULL MERGE | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div></div></div><ul><li>CLEAR CACHE</li></ul><div class="language-sql line-numbers-mode" data-ext="sql"><pre class="language-sql"><code>Eg: IoTDB <span class="token operator">></span> CLEAR CACHE | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>SET STSTEM TO READONLY / WRITABLE</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > SET STSTEM TO READONLY / WRITABLE | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>SCHEMA SNAPSHOT</li></ul><div class="language-sql line-numbers-mode" data-ext="sql"><pre class="language-sql"><code>Eg: IoTDB <span class="token operator">></span> <span class="token keyword">CREATE</span> <span class="token keyword">SNAPSHOT</span> <span class="token keyword">FOR</span> <span class="token keyword">SCHEMA</span> | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>Query abort</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > KILL QUERY 1 | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><h6 id="watermark-tool" tabindex="-1"><a class="header-anchor" href="#watermark-tool" aria-hidden="true">#</a> Watermark Tool</h6><ul><li>Watermark new users</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > grant watermark_embedding to Alice | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div><ul><li>Watermark Detection</li></ul><div class="language-text line-numbers-mode" data-ext="text"><pre class="language-text"><code>Eg: IoTDB > revoke watermark_embedding from Alice | |
| </code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div></div></div>`,49);function Le(we,Ae){const l=a("RouterLink"),r=a("ExternalLinkIcon");return o(),u("div",null,[c(` | |
| Licensed to the Apache Software Foundation (ASF) under one | |
| or more contributor license agreements. See the NOTICE file | |
| distributed with this work for additional information | |
| regarding copyright ownership. The ASF licenses this file | |
| to you under the Apache License, Version 2.0 (the | |
| "License"); you may not use this file except in compliance | |
| with the License. You may obtain a copy of the License at | |
| http://www.apache.org/licenses/LICENSE-2.0 | |
| Unless required by applicable law or agreed to in writing, | |
| software distributed under the License is distributed on an | |
| "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | |
| KIND, either express or implied. See the License for the | |
| specific language governing permissions and limitations | |
| under the License. | |
| `),m,v,e("p",null,[t("We will show you basic user privilege management operations through the following specific examples. Detailed SQL syntax and usage details can be found in "),s(l,{to:"/UserGuide/Master/Reference/SQL-Reference.html"},{default:i(()=>[t("SQL Documentation")]),_:1}),t(". At the same time, in the JAVA programming environment, you can use the "),s(l,{to:"/UserGuide/Master/API/Programming-JDBC.html"},{default:i(()=>[t("Java JDBC")]),_:1}),t(" to execute privilege management statements in a single or batch mode.")]),E,e("p",null,[t("The database provides a variety of operations, and not all users can perform all operations. If a user can perform an operation, the user is said to have the privilege to perform the operation. privileges are divided into data management privilege (such as adding, deleting and modifying data) and authority management privilege (such as creation and deletion of users and roles, granting and revoking of privileges, etc.). Data management privilege often needs a path to limit its effective range. It is flexible that using "),s(l,{to:"/UserGuide/Master/Data-Concept/Data-Model-and-Terminology.html"},{default:i(()=>[t("path pattern")]),_:1}),t(" to manage privileges.")]),h,e("p",null,[t("According to the "),e("a",p,[t("sample data"),s(r)]),t(", the sample data of IoTDB might belong to different power generation groups such as ln, sgcc, etc. Different power generation groups do not want others to obtain their own database data, so we need to have data privilege isolated at the group layer.")]),b,e("table",null,[R,e("tbody",null,[I,x,T,S,_,e("tr",null,[f,L,e("td",null,[t("Eg1: "),w,t(),A,t("Eg2: "),N,O,t("Eg3: "),y,D,t("Eg4: "),U,P,t("Eg5: "),G,B,t("Eg6: "),M,V,t("Eg7: "),s(l,{to:"/UserGuide/Master/Query-Data/Overview.html"},{default:i(()=>[t("Query-Data")]),_:1}),t("（The query statements under this section all use this permission）"),C,t("Eg8: CVS format data export"),k,F,Q,t("Eg9: Performance Tracing Tool"),q,K,W,t("Eg10: UDF-Query"),Y,H,J,t("Eg11: Triggers-Query"),j,z,X,t("Eg12: Count-Query"),Z,$])]),ee,te,se,le,ie,ne,ae,re,de,oe,ue,ce,ge,me,ve,Ee,he,pe,be,Re,Ie,xe,Te,Se,_e])]),fe])}const Oe=d(g,[["render",Le],["__file","Administration.html.vue"]]);export{Oe as default}; |