Identity authentication

The identity authentication feature validates the user identity when a user logs on to a database to access data, verifies whether the user can be associated with a database user, and implements security control on the activities of the user in the database based on the privileges of the associated database user. This topic describes user identity authentication in the MySQL mode of OceanBase Database.

In user identity authentication of OceanBase Database, a client that attempts to connect to an OBServer node must provide valid credentials. After the OBServer node verifies the validity of the credentials, it allows the client to access OceanBase Database. OceanBase Database uses the MySQL authentication protocol for user authentication. This protocol authenticates clients based on MySQL accounts on the clients. Only the clients with the correct username and password are allowed to connect to OBServer nodes. After a client initiates a connection request to an OBServer node, the OBServer node sends a random identification code to the client. The client must decode the identification code using the correct username and password, and then return the decoded result to the OBServer node. If the result is correct, the OBServer node allows the client to connect to the OBServer node.

Examples

In the MySQL mode of OceanBase Database, a user is identified by a username and a host. Execute the following statements to create three users with the same username:

create user 'u1'@'%' identified by '*******';
create user 'u1'@'10.xxx.xxx.1' identified by '*******';
create user 'u1'@'10.xxx.xxx.2' identified by '*******';

where

• % indicates that the tenant is accessible to clients with any IP address.
• 10.xxx.xxx.1 indicates that the tenant is accessible only to the client whose IP address is 10.xxx.xxx.1.
• 10.xxx.xxx.2 indicates that the tenant is accessible only to the client whose IP address is 10.xxx.xxx.2.

When you log on to an OBServer node, the OBServer node authenticates your identity based on the settings of user_name, client_ip, and password.