Set and view the tenant allowlist

You can use the tenant allowlist feature to allow only specific clients to access a tenant.

Background

The tenant allowlist contains a list of IP addresses of clients that are allowed to access a tenant. You can set the tenant allowlist based on your business requirements. IP addresses in the tenant allowlist can be in one of the following formats:

• Regular IP addresses. Example: 10.10.10.10,10.10.10.11

• Subnet/mask. Example: 10.10.10.0/24

• Fuzzy match. Example: 10.10.10.% or 10.10.10._

• Mixed format. Example: 10.10.10.10,10.10.10.11,10.10.10.%,10.10.10._,10.10.10.0/24

Procedure

To set IP addresses in the tenant allowlist, you need to specify the ob_tcp_invited_nodes parameter, which is a global parameter for a tenant. The default value is 127.0.0.1,::1, which indicates that the tenant is accessible only to the clients on the server where the tenant is hosted.

To view and set the tenant allowlist by using SQL statements, perform the following operations:

1. Log on to a tenant of the database as the administrator.

2. Execute the following statement to view the tenant allowlist:

   obclient> SHOW VARIABLES LIKE 'ob_tcp_invited_nodes';
   +----------------------+-------+
   | Variable_name        | Value |
   +----------------------+-------+
   | ob_tcp_invited_nodes | %     |
   +----------------------+-------+
   

   A value of % indicates that the tenant is accessible to clients with any IP address.

3. To modify the allowlist, execute the following statements:

   Sample code:

   obclient> SET GLOBAL ob_tcp_invited_nodes='%';
   
   obclient> SET GLOBAL ob_tcp_invited_nodes='10.10.10.%';