mirror of
https://github.com/ClickHouse/ClickHouse.git
synced 2026-10-28 16:18:23 +08:00
Alexey MilovidovandClaude Opus 5
b40982f941
The `default` user in the `users.xml` file that ships with ClickHouse has
`access_management` and `named_collection_control` enabled, but not
`show_named_collections_secrets`, so it does not have the complete set of
privileges. A user can only grant the privileges that they have themselves,
so `GRANT ALL ON *.* TO clickhouse_admin WITH GRANT OPTION` - the query the
documentation tells you to run when bootstrapping a SQL administrator - is
rejected with:
Not enough privileges. To execute this query, it's necessary to have the
grant ALL ON *.* WITH GRANT OPTION.
(Missing permissions: SHOW NAMED COLLECTIONS SECRETS ON *)
Add `show_named_collections_secrets` commented out next to the other two
settings in `programs/server/users.xml` and `programs/server/embedded.xml`,
explaining both why it is disabled and what it costs, so that the setting is
discoverable where people look for it. The behaviour is unchanged: reading
back the credentials that are already stored in named collections stays a
separate privilege from managing the collections.
Also fix the documentation, which asks for a `show_named_collections`
setting that `UsersConfigParser` does not read - it was folded into
`NAMED COLLECTION ADMIN` - and which claimed that SQL-driven access control
is disabled by default for every user, and add reference sections for
`named_collection_control` and `show_named_collections_secrets`.
Closes: https://github.com/ClickHouse/ClickHouse/issues/47092
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
106 lines
3.6 KiB
XML
106 lines
3.6 KiB
XML
<!-- Config that is used when server is run without config file. -->
|
|
<clickhouse>
|
|
<logger>
|
|
<level>trace</level>
|
|
<console>true</console>
|
|
</logger>
|
|
|
|
<http_port>8123</http_port>
|
|
<tcp_port>9000</tcp_port>
|
|
<mysql_port>9004</mysql_port>
|
|
<postgresql_port>9005</postgresql_port>
|
|
|
|
<path>./</path>
|
|
|
|
<mlock_executable>true</mlock_executable>
|
|
|
|
<!-- The `default` single-node cluster, same as in the packaged `config.xml`. Without it a
|
|
server started with no config file has no clusters at all, so `cluster('default', ...)`,
|
|
`clusterAllReplicas('default', ...)` and `cluster_for_parallel_replicas = 'default'` all
|
|
fail with `CLUSTER_DOESNT_EXIST`. -->
|
|
<remote_servers>
|
|
<default>
|
|
<shard>
|
|
<replica>
|
|
<host>localhost</host>
|
|
</replica>
|
|
</shard>
|
|
</default>
|
|
</remote_servers>
|
|
|
|
<send_crash_reports>
|
|
<enabled>true</enabled>
|
|
<send_logical_errors>true</send_logical_errors>
|
|
<endpoint>https://crash.clickhouse.com/</endpoint>
|
|
</send_crash_reports>
|
|
|
|
<http_options_response>
|
|
<header>
|
|
<name>Access-Control-Allow-Origin</name>
|
|
<value>*</value>
|
|
</header>
|
|
<header>
|
|
<name>Access-Control-Allow-Headers</name>
|
|
<value>origin, x-requested-with, x-clickhouse-format, x-clickhouse-user, x-clickhouse-key, Authorization</value>
|
|
</header>
|
|
<header>
|
|
<name>Access-Control-Allow-Methods</name>
|
|
<value>POST, GET, OPTIONS</value>
|
|
</header>
|
|
<header>
|
|
<name>Access-Control-Max-Age</name>
|
|
<value>86400</value>
|
|
</header>
|
|
</http_options_response>
|
|
|
|
<users>
|
|
<default>
|
|
<password></password>
|
|
|
|
<networks>
|
|
<ip>::/0</ip>
|
|
</networks>
|
|
|
|
<profile>default</profile>
|
|
<quota>default</quota>
|
|
|
|
<access_management>1</access_management>
|
|
<named_collection_control>1</named_collection_control>
|
|
|
|
<!-- Uncomment to also let this user see the values stored in named collections.
|
|
Without it the user does not have the complete set of privileges,
|
|
and a query such as `GRANT ALL ON *.* TO another_user WITH GRANT OPTION` will be rejected. -->
|
|
<!-- <show_named_collections_secrets>1</show_named_collections_secrets> -->
|
|
</default>
|
|
</users>
|
|
|
|
<profiles>
|
|
<default/>
|
|
</profiles>
|
|
|
|
<quotas>
|
|
<default />
|
|
</quotas>
|
|
|
|
<user_directories>
|
|
<users_xml>
|
|
<path>config.xml</path>
|
|
</users_xml>
|
|
<local_directory>
|
|
<path>access/</path>
|
|
</local_directory>
|
|
</user_directories>
|
|
|
|
<access_control_improvements>
|
|
<users_without_row_policies_can_read_rows>true</users_without_row_policies_can_read_rows>
|
|
<on_cluster_queries_require_cluster_grant>true</on_cluster_queries_require_cluster_grant>
|
|
<select_from_system_db_requires_grant>true</select_from_system_db_requires_grant>
|
|
<select_from_information_schema_requires_grant>true</select_from_information_schema_requires_grant>
|
|
<settings_constraints_replace_previous>true</settings_constraints_replace_previous>
|
|
<table_engines_require_grant>true</table_engines_require_grant>
|
|
<enable_read_write_grants>true</enable_read_write_grants>
|
|
<enable_user_name_access_type>true</enable_user_name_access_type>
|
|
<throw_on_invalid_replicated_access_entities>true</throw_on_invalid_replicated_access_entities>
|
|
</access_control_improvements>
|
|
</clickhouse>
|