下述为用户权限管理语句的语法：

  2.     GRANT privilege_type_list ON privilege_level TO user_option_list [WITH GRANT OPTION];
  4. revoke_stmt:
  5.     REVOKE privilege_type_list ON privilege_level FROM user_name_list;
  7. show_grants_stmt:
  8.     SHOW GRANTS [FOR user_name];
  10. privilege_type_list:
  11.     {ALL [PRIVILEGES] | privilege_type [, privilege_type ...]}
  13. privilege_type:
  14.       ALTER
  15.     | CREATE
  16.     | CREATE USER
  17.     | CREATE VIEW
  18.     | DELETE
  19.     | DROP
  20.     | GRANT OPTION
  21.     | INDEX
  22.     | INSERT
  23.     | PROCESS
  24.     | SHOW DATABASES
  25.     | SHOW VIEW
  27.     | UPDATE
  28.     | USAGE
  30. privilege_level:
  31.       *
  32.     | *.*
  33.     | database_name.*
  34.     | database_name.table_name
  35.     | table_name
  37. user_option_list:
  38.     user_option [, user_option ...]
  40. user_option:
  41.     user_name [IDENTIFIED BY 'password']
  43. password:
  44.     STR_VALUE
  46. user_name_list:
  47.     user_name [, user_name ...]

下述为用户管理语法树：

  1. create_user_stmt:
  2.     CREATE USER [IF NOT EXISTS] user_name [IDENTIFIED BY "password"];
  3.       ALTER USER user_name ACCOUNT {LOCK | UNLOCK};
  5.     | SET PASSWORD [FOR user_name] = PASSWORD("password");
  6. drop_user_stmt:
  7.     DROP USER user_name_list [cascade];
  8. user_name_list:
  9.     user_name [, user_name ...]
  10. password:
  11.     STR_VALUE

ob_tcp_invited_nodes 参数是租户全局的白名单限制参数。运行下述语句查看该参数以确认白名单：

  1. obclient> show variables like 'ob_tcp_invited_nodes';
  2. +----------------------+-------+
  3. | Variable_name        | Value |
  4. +----------------------+-------+
  5. | ob_tcp_invited_nodes | %     |
  6. +----------------------+-------+

Lock 用户操作：

  1. obclient>  ALTER USER demo ACCOUNT LOCK ;
  2. Query OK, 0 rows affected (0.02 sec)
  4. obclient -udemo@demo0_111 -P2881 -h11.166.87.1   -pttt
  5. obclient: [Warning] Using a password on the command line interface can be insecure.
  6. ERROR 5039 (01007): User locked

权限授予操作：

  1. obclient>  grant SELECT  on demo.*  TO demo;

权限摘除操作：

  1. obclient> revoke  SELECT  on demo.*  from demo;
  2. Query OK, 0 rows affected (0.03 sec)
  4. obclient -udemo@demo0_111 -P2881 -h11.166.87.1   -pttt
  5. ERROR 1044 (42000): Access denied for user 'DEMO'@'%' to database 'DEMO'