User preparation instructions for components

Before deploying the various components of OceanBase, you must understand the user creation mechanisms for each component. Users are divided into two levels: operating system-level users (the Linux system user that runs the process) and application system-level users (internal users of OceanBase Database and its platforms).

Operating system-level users

Operating system-level users are used to run component processes on the Linux system and manage file permissions.

Application system-level users

Application system-level users are created internally within OceanBase Database and its platforms. They are used to access and manage database or platform features.

OceanBase Database (OBServer)

System tenant user (automatically created):

Business tenant user (automatically created):

Application users that need to be manually created:

OCP (OceanBase Control Platform)

System user (automatically created):

Application users (manually created):

• O&M operators
• Read-only view users
• Users with specific feature permissions

OMS (OceanBase Migration Service)

System users (automatically created):

Application users that require manual creation:

OAT (OceanBase Admin Toolkit)

System users (automatically created):

• The default administrator user, automatically created during installation.

As a containerized deployment tool, OAT has no concept of application users and does not require additional manual user creation.

OCS (OceanBase Cluster Service)

• Default authentication user for APIs (system-level)
• Authentication user for API callers (configured based on the deployment mode)

Summary of user creation timing

Summary table of users for each component

User preparation process before deployment

Phase 1: Operating system-level preparation

1. Create necessary system users (such as admin, ocp, obproxy, etc.)
2. Configure user permissions and directory permissions.
3. Ensure the running user has appropriate permissions for the installation directory and data directory.

Phase 2: OceanBase deployment

1. Run OBD deployment with an appropriate system user.
2. OceanBase automatically creates system users such as root@sys and proxyro@sys.
3. Immediately change the password of the default system user after deployment is complete.

Phase 3: Component deployment

1. Install each component as the appropriate system user.
2. The components automatically create their internal system users (for example, admin for OCP and admin for OMS).

Phase 4: Create application users (must be done manually)

1. Create the OBAgent monitoring user monitor in the sys tenant and grant it the SELECT privilege.
2. To enable incremental synchronization with OMS, create the __oceanbase_inner_drc_user user in the source OB.
3. Create business application connection users as needed.

Phase 5: Configure permissions

1. Configure appropriate permissions for system and application users.
2. Test whether the functionality of each user is normal.

Considerations

1. OBAgent monitoring user: The monitor user is the only database user that must be manually created. Ensure this is completed before deployment; otherwise, OBAgent cannot collect database metrics and the monitoring feature will be unavailable.

2. OMS DRC user: In incremental data synchronization scenarios, you must manually create the __oceanbase_inner_drc_user user in the source OB.

3. Logical differences between OAT and OBServer users: OAT automatically creates the admin user and this cannot be changed; the admin system user for OBServer must be manually created. These two mechanisms are different, so be careful to distinguish them during deployment to avoid confusion.

4. Default password security:

   • Immediately change the root@sys password after installation.
   • Change the default admin passwords for platforms such as OCP and OMS.
   • Use a random password for proxyro in V4.0+ for higher security.

5. Principle of least privilege:

   • Separate system management users from application users.
   • Use different database users for different businesses.
   • Assign permissions following the principle of least privilege.
   • Regularly audit user permissions.

6. Version differences: User creation mechanisms may vary slightly across different OceanBase versions. It is recommended to refer to the official documentation for the corresponding version.