权限管理-用户组

gbase8a 支持用户租概念，用户组功能是把有相同权限的用户组成一个组，用户只需要修改组的权限，该组下

所有用户的权限都将发生更改，便于对拥有相同权限用户进行管理。
 

总结：一个数据库用户，可以添加到多个用户组，并拥有这些用户组的权限，也可以对该数据库用户单独进行赋权。

具体使用方式如下：

创建一个用户组

gbase> create role users_a;
Query OK, 0 rows affected (Elapsed: 00:00:00.01)

给用户组赋权

gbase> grant select,alter,drop,delete,update on ssbm.* to users_a;
Query OK, 0 rows affected (Elapsed: 00:00:00.01)

创建用户
gbase> create user tans;
Query OK, 0 rows affected (Elapsed: 00:00:00.02)

将用户添加到用户组
gbase> grant users_a to tans;
Query OK, 0 rows affected (Elapsed: 00:00:00.00)

查看用户权限

gbase> show grants for tans;
+--------------------------------------------------------------+
| Grants for tans@%                                       |
+--------------------------------------------------------------+
| GRANT USAGE ON *.*.* TO 'tans'@'%' WITH TASK_PRIORITY 2 |
| GRANT "users_a" TO "tans"                               |
+--------------------------------------------------------------+
2 rows in set (Elapsed: 00:00:00.00)

查看用户组权限

gbase> show grants for users_a;
+-------------------------------------------------------------------------------------------------------------------------------+
| Grants for users_a@%                                                                                                          |
+-------------------------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.*.* TO 'users_a'@'%' IDENTIFIED BY PASSWORD '*273A88CB37BFAB343D2A9DB9FAC9E15FE959B38A' WITH TASK_PRIORITY 0 |
| GRANT SELECT, UPDATE, DELETE, DROP, ALTER ON "vc00001"."ssbm".* TO 'users_a'@'%'                                              |
+-------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (Elapsed: 00:00:00.00)

可以单独给用户赋权

gbase> grant select,alter,drop,delete,update on test.* to tans;
Query OK, 0 rows affected (Elapsed: 00:00:00.01)

gbase> show grants for tans;
+------------------------------------------------------------------------------------+
| Grants for tans@%                                                             |
+------------------------------------------------------------------------------------+
| GRANT USAGE ON *.*.* TO 'tans'@'%' WITH TASK_PRIORITY 2                       |
| GRANT SELECT, UPDATE, DELETE, DROP, ALTER ON "vc00001"."test".* TO 'tans'@'%' |
| GRANT "users_a" TO "tans"                                                     |
+------------------------------------------------------------------------------------+
3 rows in set (Elapsed: 00:00:00.00)

创建新的用户组并赋权

gbase> create role users_b;
Query OK, 0 rows affected (Elapsed: 00:00:00.00)

gbase> grant drop,delete on test.* to users_b;
Query OK, 0 rows affected (Elapsed: 00:00:00.01)

将用户添加到用户组

gbase> grant users_b to tans;
Query OK, 0 rows affected (Elapsed: 00:00:00.00)

gbase> show grants for tans;
+------------------------------------------------------------------------------------+
| Grants for tans@%                                                             |
+------------------------------------------------------------------------------------+
| GRANT USAGE ON *.*.* TO 'tans'@'%' WITH TASK_PRIORITY 2                       |
| GRANT SELECT, UPDATE, DELETE, DROP, ALTER ON "vc00001"."test".* TO 'tans'@'%' |
| GRANT "users_a" TO "tans"                                                     |
| GRANT "users_b" TO "tans"                                                     |
+------------------------------------------------------------------------------------+
4 rows in set (Elapsed: 00:00:00.00)

gbase> show grants for users_b;
+-------------------------------------------------------------------------------------------------------------------------------+
| Grants for users_b@%                                                                                                          |
+-------------------------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON *.*.* TO 'users_b'@'%' IDENTIFIED BY PASSWORD '*273A88CB37BFAB343D2A9DB9FAC9E15FE959B38A' WITH TASK_PRIORITY 0 |
| GRANT DELETE, DROP ON "vc00001"."test".* TO 'users_b'@'%'                                                                     |
+-------------------------------------------------------------------------------------------------------------------------------+
2 rows in set (Elapsed: 00:00:00.00)

总结：一个数据库用户，可以添加到多个用户组，并拥有这些用户组的权限，也可以对该数据库用户单独进行赋权。