The authentication feature is used to verify the identity of a user who attempts to log on to OceanBase Database in MySQL mode. This feature checks whether the user can be associated with a certain database user and implements security control on the user's data access activities in the database based on the associated database user's privileges. This topic explains the authentication feature in OceanBase Database's MySQL mode.
Authentication in OceanBase Database refers to providing valid user credentials when a client attempts to access an OBServer node. If the OBServer node confirms the validity of the provided credentials, it allows the client to access OceanBase Database. OceanBase Database uses a protocol called MySQL Authentication Protocol (MAPI) to perform authentication. This protocol authenticates clients based on MySQL accounts on the clients, meaning only clients with the correct username and password can connect to OBServer nodes. When a client sends a connection request to an OBServer node, the OBServer node sends a random identification code to the client. The client must use the correct username and password to decode this code, and then return the decoded result to the OBServer node. If the result is correct, the OBServer node allows the client to connect to the OBServer node.
Example
In MySQL mode, a user is identified by a username and a host. Execute the statements below to create three users with the same username.
Sample code:
create user 'u1'@'%' identified by '***1***';
create user 'u1'@'10.xxx.xxx.1' identified by '***1***';
create user 'u1'@'10.xxx.xxx.2' identified by '***1***';
where
%indicates allowing clients with any IP address to connect to the tenant.10.xxx.xxx.1indicates allowing only the client with the IP address10.xxx.xxx.1to connect to the tenant.10.xxx.xxx.2indicates allowing only the client with the IP address10.xxx.xxx.2to connect to the tenant.
When a user logs on, the OBServer node controls the logon based on the user_name, client_ip, and password.