Skip to content

Commit 32c8028

Browse files
CRZbulabulaCRZbulabula
authored
Patch for rename user and audit log (apache#16535)
* Fix audit logger * Fix rename user bugs * Unify username parser
1 parent 6d61081 commit 32c8028

File tree

21 files changed

+163
-88
lines changed

21 files changed

+163
-88
lines changed

‎integration-test/src/test/java/org/apache/iotdb/confignode/it/regionmigration/pass/commit/IoTDBRegionReconstructForIoTV1IT.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ public void normal1C3DTest() throws Exception {
151151
EnvFactory.getEnv()
152152
.getConnection(
153153
EnvFactory.getEnv().dataNodeIdToWrapper(dataNodeToBeReconstructed).get(),
154-
CommonDescriptor.getInstance().getConfig().getAdminName(),
154+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
155155
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
156156
BaseEnv.TREE_SQL_DIALECT);
157157
Statement flushStatement = flushConn.createStatement()) {

‎integration-test/src/test/java/org/apache/iotdb/db/it/auth/IoTDBUserRenameIT.java‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,11 @@ private void userRenameTest(String dialect) throws SQLException {
6868
Statement adminStmt = adminCon.createStatement()) {
6969
adminStmt.execute("CREATE USER user1 'IoTDB@2021abc'");
7070
adminStmt.execute("CREATE USER user2 'IoTDB@2023abc'");
71+
if (BaseEnv.TABLE_SQL_DIALECT.equals(dialect)) {
72+
adminStmt.execute("GRANT SECURITY TO USER user2");
73+
} else {
74+
adminStmt.execute("GRANT SECURITY ON root.** TO USER user2");
75+
}
7176
try (Connection userCon =
7277
EnvFactory.getEnv().getConnection("user1", "IoTDB@2021abc", dialect);
7378
Statement userStmt = userCon.createStatement()) {
@@ -77,20 +82,36 @@ private void userRenameTest(String dialect) throws SQLException {
7782
// A normal user can only rename himself
7883
userStmt.execute("ALTER USER user1 RENAME TO user3");
7984
}
85+
try (Connection userCon =
86+
EnvFactory.getEnv().getConnection("user2", "IoTDB@2023abc", dialect);
87+
Statement userStmt = userCon.createStatement()) {
88+
// User with SECURITY privilege can rename other users
89+
userStmt.execute("ALTER USER user3 RENAME TO user1");
90+
// Nobody can rename superuser
91+
Assert.assertThrows(
92+
SQLException.class, () -> userStmt.execute("ALTER USER root RENAME TO admin"));
93+
}
8094
// Cannot rename an unexisting user
8195
Assert.assertThrows(
8296
SQLException.class, () -> adminStmt.execute("ALTER USER user4 RENAME TO user5"));
8397
// Cannot rename to an already existed user
8498
Assert.assertThrows(
85-
SQLException.class, () -> adminStmt.execute("ALTER USER user2 RENAME TO user3"));
86-
// The superuser can rename anyone
87-
adminStmt.execute("ALTER USER user3 RENAME TO user4");
99+
SQLException.class, () -> adminStmt.execute("ALTER USER user2 RENAME TO user1"));
100+
// Cannot rename to an illegal name
101+
Assert.assertThrows(
102+
SQLException.class, () -> adminStmt.execute("ALTER USER user2 RENAME TO p00"));
103+
// Only the superuser can rename him/herself
88104
adminStmt.execute("ALTER USER root RENAME TO admin");
89105
}
90-
// Ensure every rename works
91106
try (Connection adminCon = EnvFactory.getEnv().getConnection("admin", "root", dialect);
92107
Statement adminStmt = adminCon.createStatement()) {
93-
final String ans = "0,admin,\n" + "10000,user4,\n" + "10001,user2,\n";
108+
// We can rename other user to root
109+
adminStmt.execute("ALTER USER user1 RENAME TO root");
110+
adminStmt.execute("ALTER USER root RENAME TO user4");
111+
// We can create another root
112+
adminStmt.execute("CREATE USER root 'IoTDB@2025abc'");
113+
// Ensure everything works
114+
final String ans = "0,admin,\n" + "10000,user4,\n" + "10001,user2,\n" + "10002,root,\n";
94115
ResultSet resultSet = adminStmt.executeQuery("LIST USER");
95116
validateResultSet(resultSet, ans);
96117
}

‎integration-test/src/test/java/org/apache/iotdb/relational/it/query/old/builtinfunction/scalar/IoTDBBitwiseFunctionTableIT.java‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ public void bitCountTestError1() {
148148
EnvFactory.getEnv(),
149149
"select time,s2,s3,bit_count(9,64),bit_count(s2,64),bit_count(s2,s3) from bit_count_error_table",
150150
"Argument exception, the scalar function num must be representable with the bits specified. 9 cannot be represented with 2 bits.",
151-
CommonDescriptor.getInstance().getConfig().getAdminName(),
151+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
152152
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
153153
DATABASE_NAME);
154154
}
@@ -159,7 +159,7 @@ public void bitCountTestError2() {
159159
EnvFactory.getEnv(),
160160
"select time,s2,s3,bit_count(9,1),bit_count(s2,1),bit_count(s2,s3) from bit_count_error_table",
161161
"Argument exception, the scalar function bit_count bits must be between 2 and 64.",
162-
CommonDescriptor.getInstance().getConfig().getAdminName(),
162+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
163163
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
164164
DATABASE_NAME);
165165
}
@@ -170,15 +170,15 @@ public void bitCountTestWithNonInteger() {
170170
EnvFactory.getEnv(),
171171
"select time, bit_count(s4) from bit_count_error_table",
172172
"701: Scalar function bit_count only accepts two arguments and they must be Int32 or Int64 data type.",
173-
CommonDescriptor.getInstance().getConfig().getAdminName(),
173+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
174174
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
175175
DATABASE_NAME);
176176

177177
assertTableTestFail(
178178
EnvFactory.getEnv(),
179179
"select time, bit_count(s1,s4) from bit_count_error_table",
180180
"701: Scalar function bit_count only accepts two arguments and they must be Int32 or Int64 data type.",
181-
CommonDescriptor.getInstance().getConfig().getAdminName(),
181+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
182182
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
183183
DATABASE_NAME);
184184
}
@@ -204,15 +204,15 @@ public void bitwiseAndTestWithNonInteger() {
204204
EnvFactory.getEnv(),
205205
"select time, bitwise_and(s4) from bitwise_and_table",
206206
"701: Scalar function bitwise_and only accepts two arguments and they must be Int32 or Int64 data type.",
207-
CommonDescriptor.getInstance().getConfig().getAdminName(),
207+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
208208
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
209209
DATABASE_NAME);
210210

211211
assertTableTestFail(
212212
EnvFactory.getEnv(),
213213
"select time, bitwise_and(s1,s4) from bitwise_and_table",
214214
"701: Scalar function bitwise_and only accepts two arguments and they must be Int32 or Int64 data type.",
215-
CommonDescriptor.getInstance().getConfig().getAdminName(),
215+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
216216
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
217217
DATABASE_NAME);
218218
}
@@ -240,15 +240,15 @@ public void bitwiseNotTestWithNonInteger() {
240240
EnvFactory.getEnv(),
241241
"select time, bitwise_not(s4) from bitwise_not_table",
242242
"701: Scalar function bitwise_not only accepts one argument and it must be Int32 or Int64 data type.",
243-
CommonDescriptor.getInstance().getConfig().getAdminName(),
243+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
244244
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
245245
DATABASE_NAME);
246246

247247
assertTableTestFail(
248248
EnvFactory.getEnv(),
249249
"select time, bitwise_not(s1,s4) from bitwise_not_table",
250250
"701: Scalar function bitwise_not only accepts one argument and it must be Int32 or Int64 data type.",
251-
CommonDescriptor.getInstance().getConfig().getAdminName(),
251+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
252252
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
253253
DATABASE_NAME);
254254
}
@@ -274,15 +274,15 @@ public void bitwiseOrTestWithNonInteger() {
274274
EnvFactory.getEnv(),
275275
"select time, bitwise_or(s4) from bitwise_or_table",
276276
"701: Scalar function bitwise_or only accepts two arguments and they must be Int32 or Int64 data type.",
277-
CommonDescriptor.getInstance().getConfig().getAdminName(),
277+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
278278
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
279279
DATABASE_NAME);
280280

281281
assertTableTestFail(
282282
EnvFactory.getEnv(),
283283
"select time, bitwise_or(s1,s4) from bitwise_or_table",
284284
"701: Scalar function bitwise_or only accepts two arguments and they must be Int32 or Int64 data type.",
285-
CommonDescriptor.getInstance().getConfig().getAdminName(),
285+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
286286
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
287287
DATABASE_NAME);
288288
}
@@ -308,15 +308,15 @@ public void bitwiseXorTestWithNonInteger() {
308308
EnvFactory.getEnv(),
309309
"select time, bitwise_xor(s4) from bitwise_xor_table",
310310
"701: Scalar function bitwise_xor only accepts two arguments and they must be Int32 or Int64 data type.",
311-
CommonDescriptor.getInstance().getConfig().getAdminName(),
311+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
312312
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
313313
DATABASE_NAME);
314314

315315
assertTableTestFail(
316316
EnvFactory.getEnv(),
317317
"select time, bitwise_xor(s1,s4) from bitwise_xor_table",
318318
"701: Scalar function bitwise_xor only accepts two arguments and they must be Int32 or Int64 data type.",
319-
CommonDescriptor.getInstance().getConfig().getAdminName(),
319+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
320320
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
321321
DATABASE_NAME);
322322
}
@@ -347,15 +347,15 @@ public void bitwiseLeftShiftTestWithNonInteger() {
347347
EnvFactory.getEnv(),
348348
"select time, bitwise_left_shift(s4) from bitwise_left_shift_table",
349349
"701: Scalar function bitwise_left_shift only accepts two arguments and they must be Int32 or Int64 data type.",
350-
CommonDescriptor.getInstance().getConfig().getAdminName(),
350+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
351351
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
352352
DATABASE_NAME);
353353

354354
assertTableTestFail(
355355
EnvFactory.getEnv(),
356356
"select time, bitwise_left_shift(s1,s4) from bitwise_left_shift_table",
357357
"701: Scalar function bitwise_left_shift only accepts two arguments and they must be Int32 or Int64 data type.",
358-
CommonDescriptor.getInstance().getConfig().getAdminName(),
358+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
359359
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
360360
DATABASE_NAME);
361361
}
@@ -388,15 +388,15 @@ public void bitwiseRightShiftTestWithNonInteger() {
388388
EnvFactory.getEnv(),
389389
"select time, bitwise_right_shift(s4) from bitwise_right_shift_table",
390390
"701: Scalar function bitwise_right_shift only accepts two arguments and they must be Int32 or Int64 data type.",
391-
CommonDescriptor.getInstance().getConfig().getAdminName(),
391+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
392392
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
393393
DATABASE_NAME);
394394

395395
assertTableTestFail(
396396
EnvFactory.getEnv(),
397397
"select time, bitwise_right_shift(s1,s4) from bitwise_right_shift_table",
398398
"701: Scalar function bitwise_right_shift only accepts two arguments and they must be Int32 or Int64 data type.",
399-
CommonDescriptor.getInstance().getConfig().getAdminName(),
399+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
400400
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
401401
DATABASE_NAME);
402402
}
@@ -423,15 +423,15 @@ public void bitwiseRightShiftArithmeticTestWithNonInteger() {
423423
EnvFactory.getEnv(),
424424
"select time, bitwise_right_shift_arithmetic(s4) from bitwise_right_shift_arithmetic_table",
425425
"701: Scalar function bitwise_right_shift_arithmetic only accepts two arguments and they must be Int32 or Int64 data type.",
426-
CommonDescriptor.getInstance().getConfig().getAdminName(),
426+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
427427
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
428428
DATABASE_NAME);
429429

430430
assertTableTestFail(
431431
EnvFactory.getEnv(),
432432
"select time, bitwise_right_shift_arithmetic(s1,s4) from bitwise_right_shift_arithmetic_table",
433433
"701: Scalar function bitwise_right_shift_arithmetic only accepts two arguments and they must be Int32 or Int64 data type.",
434-
CommonDescriptor.getInstance().getConfig().getAdminName(),
434+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName(),
435435
CommonDescriptor.getInstance().getConfig().getAdminPassword(),
436436
DATABASE_NAME);
437437
}

‎integration-test/src/test/java/org/apache/iotdb/session/it/IoTDBSessionCompressedIT.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ public static void setUpClass() throws IoTDBConnectionException {
6363
ITableSession session1 =
6464
new TableSessionBuilder()
6565
.nodeUrls(nodeUrls)
66-
.username(CommonDescriptor.getInstance().getConfig().getAdminName())
66+
.username(CommonDescriptor.getInstance().getConfig().getDefaultAdminName())
6767
.password(CommonDescriptor.getInstance().getConfig().getAdminPassword())
6868
.enableCompression(true)
6969
.enableRedirection(true)
@@ -83,7 +83,7 @@ public static void setUpClass() throws IoTDBConnectionException {
8383
ITableSession session2 =
8484
new TableSessionBuilder()
8585
.nodeUrls(nodeUrls)
86-
.username(CommonDescriptor.getInstance().getConfig().getAdminName())
86+
.username(CommonDescriptor.getInstance().getConfig().getDefaultAdminName())
8787
.password(CommonDescriptor.getInstance().getConfig().getAdminPassword())
8888
.enableCompression(true)
8989
.enableRedirection(true)
@@ -103,7 +103,7 @@ public static void setUpClass() throws IoTDBConnectionException {
103103
ITableSession session3 =
104104
new TableSessionBuilder()
105105
.nodeUrls(nodeUrls)
106-
.username(CommonDescriptor.getInstance().getConfig().getAdminName())
106+
.username(CommonDescriptor.getInstance().getConfig().getDefaultAdminName())
107107
.password(CommonDescriptor.getInstance().getConfig().getAdminPassword())
108108
.enableCompression(true)
109109
.enableRedirection(true)
@@ -123,7 +123,7 @@ public static void setUpClass() throws IoTDBConnectionException {
123123
ITableSession session4 =
124124
new TableSessionBuilder()
125125
.nodeUrls(nodeUrls)
126-
.username(CommonDescriptor.getInstance().getConfig().getAdminName())
126+
.username(CommonDescriptor.getInstance().getConfig().getDefaultAdminName())
127127
.password(CommonDescriptor.getInstance().getConfig().getAdminPassword())
128128
.enableCompression(true)
129129
.enableRedirection(true)
@@ -143,7 +143,7 @@ public static void setUpClass() throws IoTDBConnectionException {
143143
ITableSession session5 =
144144
new TableSessionBuilder()
145145
.nodeUrls(nodeUrls)
146-
.username(CommonDescriptor.getInstance().getConfig().getAdminName())
146+
.username(CommonDescriptor.getInstance().getConfig().getDefaultAdminName())
147147
.password(CommonDescriptor.getInstance().getConfig().getAdminPassword())
148148
.enableCompression(false)
149149
.enableRedirection(true)

‎iotdb-core/antlr/src/main/antlr4/org/apache/iotdb/db/qp/sql/IoTDBSqlParser.g4‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1046,7 +1046,7 @@ deleteStatement
10461046

10471047
// Create User
10481048
createUser
1049-
: CREATE USER userName=identifier password=STRING_LITERAL
1049+
: CREATE USER userName=usernameWithRoot password=STRING_LITERAL
10501050
;
10511051

10521052
// Create Role
@@ -1061,7 +1061,7 @@ alterUser
10611061

10621062
// Rename user
10631063
renameUser
1064-
: ALTER USER username=usernameWithRoot RENAME TO newUsername=identifier
1064+
: ALTER USER username=usernameWithRoot RENAME TO newUsername=usernameWithRoot
10651065
;
10661066

10671067
// ---- Alter User Account Unlock
@@ -1071,7 +1071,7 @@ alterUserAccountUnlock
10711071

10721072
// Grant User Privileges
10731073
grantUser
1074-
: GRANT privileges ON prefixPath (COMMA prefixPath)* TO USER userName=identifier (grantOpt)?
1074+
: GRANT privileges ON prefixPath (COMMA prefixPath)* TO USER userName=usernameWithRoot (grantOpt)?
10751075
;
10761076

10771077
// Grant Role Privileges
@@ -1086,12 +1086,12 @@ grantOpt
10861086

10871087
// Grant User Role
10881088
grantRoleToUser
1089-
: GRANT ROLE roleName=identifier TO userName=identifier
1089+
: GRANT ROLE roleName=identifier TO userName=usernameWithRoot
10901090
;
10911091

10921092
// Revoke User Privileges
10931093
revokeUser
1094-
: REVOKE privileges ON prefixPath (COMMA prefixPath)* FROM USER userName=identifier
1094+
: REVOKE privileges ON prefixPath (COMMA prefixPath)* FROM USER userName=usernameWithRoot
10951095
;
10961096

10971097
// Revoke Role Privileges
@@ -1101,12 +1101,12 @@ revokeRole
11011101

11021102
// Revoke Role From User
11031103
revokeRoleFromUser
1104-
: REVOKE ROLE roleName=identifier FROM userName=identifier
1104+
: REVOKE ROLE roleName=identifier FROM userName=usernameWithRoot
11051105
;
11061106

11071107
// Drop User
11081108
dropUser
1109-
: DROP USER userName=identifier
1109+
: DROP USER userName=usernameWithRoot
11101110
;
11111111

11121112
// Drop Role

‎iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/receiver/protocol/IoTDBConfigNodeReceiver.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -325,7 +325,7 @@ private TSStatus checkPermission(final ConfigPhysicalPlan plan) {
325325
case CreateSchemaTemplate:
326326
case CommitSetSchemaTemplate:
327327
case PipeUnsetTemplate:
328-
return CommonDescriptor.getInstance().getConfig().getAdminName().equals(username)
328+
return CommonDescriptor.getInstance().getConfig().getDefaultAdminName().equals(username)
329329
? StatusUtils.OK
330330
: new TSStatus(TSStatusCode.NO_PERMISSION.getStatusCode())
331331
.setMessage("Only the admin user can perform this operation");

‎iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/pipe/consensuspipe/ConsensusPipeManager.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,8 @@ public void createConsensusPipe(Peer senderPeer, Peer receiverPeer, boolean need
114114
.put(EXTRACTOR_CAPTURE_TABLE_KEY, String.valueOf(true))
115115
.put(EXTRACTOR_CAPTURE_TREE_KEY, String.valueOf(true))
116116
.put(
117-
EXTRACTOR_IOTDB_USER_KEY, CommonDescriptor.getInstance().getConfig().getAdminName())
117+
EXTRACTOR_IOTDB_USER_KEY,
118+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName())
118119
.build(),
119120
ImmutableMap.<String, String>builder()
120121
.put(PROCESSOR_KEY, config.getProcessorPluginName())

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/auth/AuthorityChecker.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,8 @@
7777
public class AuthorityChecker {
7878

7979
public static int SUPER_USER_ID = 0;
80-
public static String SUPER_USER = CommonDescriptor.getInstance().getConfig().getAdminName();
80+
public static String SUPER_USER =
81+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName();
8182
public static String SUPER_USER_ID_IN_STR = "0";
8283

8384
public static final TSStatus SUCCEED = new TSStatus(TSStatusCode.SUCCESS_STATUS.getStatusCode());

‎iotdb-core/datanode/src/main/java/org/apache/iotdb/db/queryengine/plan/execution/config/executor/ClusterConfigTaskExecutor.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2678,7 +2678,7 @@ public SettableFuture<ConfigTaskResult> createTopic(
26782678
"fakePipeName",
26792679
// TODO: currently use root to create topic
26802680
temporaryTopicMeta.generateExtractorAttributes(
2681-
CommonDescriptor.getInstance().getConfig().getAdminName()),
2681+
CommonDescriptor.getInstance().getConfig().getDefaultAdminName()),
26822682
temporaryTopicMeta.generateProcessorAttributes(),
26832683
temporaryTopicMeta.generateConnectorAttributes("fakeConsumerGroupId"));
26842684
} catch (final Exception e) {

0 commit comments

Comments
 (0)