View and set the tenant allowlist

The tenant allowlist feature allows you to set which clients are allowed to access the current tenant.

Background information

The tenant allowlist is a list of clients that are allowed to log in to the tenant and is specified by the system variable ob_tcp_invited_nodes of the tenant. The default value is the IP address of the current server. You can customize the tenant allowlist based on your business requirements. The system supports the following formats for the tenant allowlist:

• Regular IP address format, for example, 10.10.10.10,10.10.10.11

• Subnet/mask format, for example, 10.10.10.0/24

• Fuzzy matching format, for example, 10.10.10.% or 10.10.10._

• Mixed format, for example, 10.10.10.10,10.10.10.11,10.10.10.%,10.10.10._,10.10.10.0/24.

View the tenant allowlist

1. Log in to the database as a tenant administrator.

   obclient -h172.30.xx.xx -P2883 -uroot@mq_t1#cluster  -A
   

2. View the tenant allowlist.

   obclient> SHOW VARIABLES LIKE 'ob_tcp_invited_nodes';
   +----------------------+-------+
   | Variable_name        | Value |
   +----------------------+-------+
   | ob_tcp_invited_nodes | %     |
   +----------------------+-------+
   

Set the tenant allowlist

You can modify the allowlist configuration of a tenant as the administrator of the sys tenant or current tenant.

Modify the tenant allowlist as the administrator of the sys tenant

1. Log in to the sys tenant of the cluster as the root user.

   obclient -h172.30.xx.xx -P2883 -uroot@sys#cluster -p**** -A
   

2. Modify the allowlist configuration of a tenant.

   obclient> ALTER TENANT mq_t1 VARIABLES ob_tcp_invited_nodes = '10.10.10.%';
   

Modify the tenant allowlist as the administrator of the current tenant

1. Log in to the database as a tenant administrator.

   obclient -h172.30.xx.xx -P2883 -uroot@mq_t1#cluster  -A
   

2. Modify the allowlist configuration of the current tenant.

   obclient> SET GLOBAL ob_tcp_invited_nodes='10.10.10.%';
   

3. After the modification, exit the current session and log in again for the modifications to take effect.

4. Query the modification result.

   obclient> SHOW VARIABLES LIKE 'ob_tcp_invited_nodes';
   +----------------------+------------+
   | Variable_name        | Value      |
   +----------------------+------------+
   | ob_tcp_invited_nodes | 10.10.10.% |
   +----------------------+------------+
   

References

ob_tcp_invited_nodes