Unveiling User and Privilege Management in GBase 8s
Effective control of data access privileges in a database system is fundamental to security, encompassing both data objects and operation types. From an information security perspective, the database management system must prevent data loss and damage from both internal and external sources. To achieve this, database administrators need to assign different privileges to each user, meeting their varied needs while restricting their capabilities to avoid data security issues such as account leaks and privilege misuse. How does GBase 8s, widely deployed in large-scale sectors like finance and telecommunications, manage privileges for different users? This article demystifies its approach from two aspects: user management and privilege management.
Overview
User management in GBase 8s differs slightly from other relational databases in the following ways:
GBase 8s allows operating system users to access the database. Once authorized, operating system users can directly access the GBase 8s database. In contrast, other relational databases typically use built-in database users and do not support direct access using operating system credentials.
GBase 8s supports creating and using internal database users to access data. This feature is disabled by default after installation; the database administrator must modify a parameter to enable it.
GBase 8s manages data access using database-level and table-level privileges.
Database-level privileges are: CONNECT, RESOURCE, and DBA. Only after obtaining a database-level privilege can a user connect to the database.
Table-level privileges are: SELECT, INSERT, UPDATE, DELETE, INDEX, ALTER, REFERENCE, and ALL.
GBase 8s has a built-in public group. The access privilege of an internal user is the sum of the standard public group privileges plus any specific privileges granted to the user. By default, the public group has SELECT, INSERT, UPDATE, DELETE, and INDEX privileges on tables. Database administrators can modify the standard public privileges as needed.
1. User Management
GBase 8s users are classified as:
Operating System Users
GBase 8s can use an operating system user to access the database after authorization.
Internal Users
1. Access via a database internal user.
2. An internal user requires an operating system user as a proxy.
3. A default user can be created to simplify user provisioning.
GBase 8s User Architecture Diagram:
Operating System Users
Creating an Operating System User
The following information uses CentOS 7 as an example to illustrate the syntax for creating and deleting operating system users.
Syntax:
Example:
On CentOS 7, it can be abbreviated as:
Note: A newly created operating system user cannot immediately access data in GBase 8s. The user must be authorized before connecting to the database and accessing data. Refer to the privilege management section below for user authorization.
Deleting an Operating System User
Syntax:
Example:
Internal Users
Internal user support in GBase 8s is disabled by default. To use internal users, you must modify the relevant parameter settings and activate them.
Configuration Parameter
Configure the USERMAPPING parameter in the onconfig file to allow internal users to access GBase 8s. When set to OFF, internal user access is denied.
Configuring an Operating System Surrogate User
The configuration file for GBase 8s surrogate users is usually located at /etc/gbasedbt/allowed.surrogates.
In this file, you can configure the surrogate users and groups. Multiple entries can be separated by commas. User configuration begins with the keyword users followed by a colon, while group configuration begins with groups followed by a colon.
Surrogate user configuration example:
The modified configuration does not take effect immediately; the database administrator must refresh the configuration information, for example by restarting the database.
Note: Be sure to create the surrogate user in advance, and after modifying this configuration parameter, update the database's surrogate user cache information.
After completing the above configuration, GBase 8s can create and use internal database users to access data.
Creating a Default Internal User
A default user can be created as a template for other internal users.
Syntax:
Example:
After creating the default user, GBase 8s will create an internal group named public.
Creating an Internal User (Using Default User Attributes as a Template)
Syntax:
Example:
Creating an Internal User (Independent Attributes)
Syntax:
Example:
2. Privilege Management
1. Privilege Classification
GBase 8s privileges are divided into database privileges and table privileges.
Database Privileges
Table Privileges
2. Granting Privileges to Users
Syntax:
Example:
By strengthening both user and privilege management, GBase 8s establishes a robust security mechanism that effectively safeguards data within the database, providing a solid foundation for data security in China's finance, telecommunications, and other industries.