RaigorJiang opened a new issue #13911:
URL: https://github.com/apache/shardingsphere/issues/13911
Hi community,
I want to make some adjustments to the native authority provider.
### Background:
Now, ShardingSphere provides 3 authority providers:
1. `ALL_PRIVILEGES_PERMITTED`
The user provides all authorizations without permission restrictions.
2. `SCHEMA_PRIVILEGES_PERMITTED`
The schema authorized for each user is configured, and the unauthorized
ones cannot be used.
3. `NATIVE`
Use native database capabilities to store user and authorization
information.
Now, `ALL_PRIVILEGES_PERMITTED` is the default authority provider.
### Problem:
`ALL_PRIVILEGES_PERMITTED` and `SCHEMA_PRIVILEGES_PERMITTED` are easy to
understand and easy to use for users, but `Native` does have some problems,
such as those mentioned in the
[discussion](https://github.com/apache/shardingsphere/discussions/12752).
On the other hand, if the user information is stored in the database:
1. Is this user a database user or a ShardingSphere user?
2. The database user is fixed when connecting to the resource. When the
proxy login user is switched, the database user will not change unless the user
alter resource.
3. Is the database user authorized or the ShardingSphere user authorized
when the grant statement is executed?
These concepts confuse users.
### Plan
After discussion and research, I have an idea to adjust the authority
feature:
- Make ShardingSphere authority storage independent of the database.
- Mark `Native` authority provider as `Deprecated`.
- Update documentation stating that `DCL` statements are not supported.
- When the user input a `DCL` Statement, an unsupported exception is thrown.
In the future, users can adjust the authority definition through `ALTER
AUTHORITY RULE`, just like [ALTER SHARDING TABLE
RULE](https://shardingsphere.apache.org/document/current/cn/user-manual/shardingsphere-proxy/distsql/syntax/rdl/rule-definition/sharding/).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
