Skip to content

Commit

Permalink
[doc] fix some sql statements doc
Browse files Browse the repository at this point in the history
  • Loading branch information
chenzhx committed Jan 24, 2025
1 parent aea49e8 commit f556fab
Show file tree
Hide file tree
Showing 48 changed files with 592 additions and 419 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,15 @@ The `ALTER ROLE` statement is used to modify a role.

## Required Parameters

**1. `<role_name>`**:The name of the role.
**<role_name>**

> The name of the role.
## Optional Parameters

**1. `<comment>`**:The comment of the role.
**<comment>**

> The comment of the role.
## Access Control Requirements

Expand Down
56 changes: 31 additions & 25 deletions docs/sql-manual/sql-statements/account-management/ALTER-USER.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,17 +38,21 @@ ALTER USER [IF EXISTS] <user_identity> [IDENTIFIED BY <password>]

## Required Parameters

**1. `<user_identity>`**:a user_identity uniquely identifies a user.The syntax is:'user_name'@'host'.
`user_identity` consists of two parts, user_name and host, where username is the username. Host identifies the host address where the client connects. The host part can use % for fuzzy matching. If no host is specified, it defaults to '%', which means the user can connect to Doris from any host.
The host part can also be specified as a domain, the syntax is: 'user_name'@['domain'], even if it is surrounded by square brackets, Doris will think this is a domain and try to resolve its ip address.
**<user_identity>**

> A user_identity uniquely identifies a user.The syntax is:'user_name'@'host'.
> `user_identity` consists of two parts, user_name and host, where username is the username. Host identifies the host address where the client connects. The host part can use % for fuzzy matching. If no host is specified, it defaults to '%', which means the user can connect to Doris from any host.
> The host part can also be specified as a domain, the syntax is: 'user_name'@['domain'], even if it is surrounded by square brackets, Doris will think this is a domain and try to resolve its ip address.
## Optional Parameters

**1. `<password>`**:Specify the user password.
**<password>**

> Specify the user password.
**<password_policy>**

**2. `<password_policy>`**

`password_policy` is a clause used to specify policies related to password authentication login. Currently, the following policies are supported:
> `password_policy` is a clause used to specify policies related to password authentication login. Currently, the following policies are supported:
```sql
- PASSWORD_HISTORY [n|DEFAULT]
Expand All @@ -58,24 +62,25 @@ The host part can also be specified as a domain, the syntax is: 'user_name'@['do
- ACCOUNT_UNLOCK
```

- `PASSWORD_HISTORY`

Whether to allow the current user to use historical passwords when resetting their passwords. For example, `PASSWORD_HISTORY 10` means that it is forbidden to use the password set in the past 10 times as a new password. If set to `PASSWORD_HISTORY DEFAULT`, the value in the global variable `password_history` will be used. `0` means do not enable this feature. Default is 0.

- `PASSWORD_EXPIRE`

Set the expiration time of the current user's password. For example `PASSWORD_EXPIRE INTERVAL 10 DAY` means the password will expire in 10 days. `PASSWORD_EXPIRE NEVER` means that the password does not expire. If set to `PASSWORD_EXPIRE DEFAULT`, the value in the global variable `default_password_lifetime` is used. Defaults to NEVER (or 0), which means it will not expire.

- `FAILED_LOGIN_ATTEMPTS` and `PASSWORD_LOCK_TIME`

When the current user logs in, if the user logs in with the wrong password for n times, the account will be locked, and the lock time is set. For example, `FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 1 DAY` means that if you log in wrongly for 3 times, the account will be locked for one day.

- ACCOUNT_UNLOCK

`ACCOUNT_UNLOCK` is used to unlock a locked user.

**3. `<comment>`**:Specify the user comment.

> - `PASSWORD_HISTORY`
>
> Whether to allow the current user to use historical passwords when resetting their passwords. For example, `PASSWORD_HISTORY 10` means that it is forbidden to use the password set in the past 10 times as a new password. If set to `PASSWORD_HISTORY DEFAULT`, the value in the global variable `password_history` will be used. `0` means do not enable this feature. Default is 0.
>
> - `PASSWORD_EXPIRE`
>
> Set the expiration time of the current user's password. For example `PASSWORD_EXPIRE INTERVAL 10 DAY` means the password will expire in 10 days. `PASSWORD_EXPIRE NEVER` means that the password does not expire. If set to `PASSWORD_EXPIRE DEFAULT`, the value in the global variable `default_password_lifetime` is used. Defaults to NEVER (or 0), which means it will not expire.
>
> - `FAILED_LOGIN_ATTEMPTS` and `PASSWORD_LOCK_TIME`
>
> When the current user logs in, if the user logs in with the wrong password for n times, the account will be locked, and the lock time is set. For example, `FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 1 DAY` means that if you log in wrongly for 3 times, the account will be locked for one day.
>
> - ACCOUNT_UNLOCK
>
> `ACCOUNT_UNLOCK` is used to unlock a locked user.
**<comment>**

>Specify the user comment.
## Access Control Requirements

Expand All @@ -88,6 +93,7 @@ The user executing this SQL command must have at least the following privileges:
## Usage Notes

1. This command give over supports modifying user roles from versions 2.0. Please use [GRANT](./GRANT.md) and [REVOKE](./REVOKE.md) for related operations

2. In an ALTER USER command, only one of the following account attributes can be modified at the same time:
- Change password
- Modify `PASSWORD_HISTORY`
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,12 +36,15 @@ The `CREATE ROLE` statement is used to create an unprivileged role, which can be

## Required Parameters

**1. `<role_name>`**:The name of the role.
**<role_name>**

> The name of the role.
## Optional Parameters

**1. `<comment>`**:The comment of the role.
**<comment>**

> The comment of the role.
## Access Control Requirements

Expand Down
48 changes: 27 additions & 21 deletions docs/sql-manual/sql-statements/account-management/CREATE-USER.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,23 +38,27 @@ CREATE USER [IF EXISTS] <user_identity> [IDENTIFIED BY <password>]
```
## Required Parameters

**1. `<user_identity>`**:a user_identity uniquely identifies a user.The syntax is:'user_name'@'host'.
**<user_identity>**

`user_identity` consists of two parts, user_name and host, where username is the username. Host identifies the host address where the client connects. The host part can use % for fuzzy matching. If no host is specified, it defaults to '%', which means the user can connect to Doris from any host.
The host part can also be specified as a domain, the syntax is: 'user_name'@['domain'], even if it is surrounded by square brackets, Doris will think this is a domain and try to resolve its ip address.
> A user_identity uniquely identifies a user.The syntax is:'user_name'@'host'.
> `user_identity` consists of two parts, user_name and host, where username is the username. Host identifies the host address where the client connects. The host part can use % for fuzzy matching. If no host is specified, it defaults to '%', which means the user can connect to Doris from any host.
> The host part can also be specified as a domain, the syntax is: 'user_name'@['domain'], even if it is surrounded by square brackets, Doris will think this is a domain and try to resolve its ip address.

## Optional Parameters

**1. `<password>`**:Specify the user password.
**<password>**

**2. `<role_name>`**Specify the user role.
> Specify the user password.
If a role (ROLE) is specified, the newly created user will be automatically granted the permissions of the role. If not specified, the user has no permissions by default. The specified ROLE must already exist.
**<role_name>**

**3. `<password_policy>`**
> Specify the user role.
> If a role (ROLE) is specified, the newly created user will be automatically granted the permissions of the role. If not specified, the user has no permissions by default. The specified ROLE must already exist.
`password_policy` is a clause used to specify policies related to password authentication login. Currently, the following policies are supported:
**<password_policy>**

> `password_policy` is a clause used to specify policies related to password authentication login. Currently, the following policies are supported:
```sql
- PASSWORD_HISTORY [n|DEFAULT]
Expand All @@ -63,19 +67,21 @@ CREATE USER [IF EXISTS] <user_identity> [IDENTIFIED BY <password>]
- PASSWORD_LOCK_TIME [n DAY/HOUR/SECOND|UNBOUNDED]
```

- `PASSWORD_HISTORY`

Whether to allow the current user to use historical passwords when resetting their passwords. For example, `PASSWORD_HISTORY 10` means that it is forbidden to use the password set in the past 10 times as a new password. If set to `PASSWORD_HISTORY DEFAULT`, the value in the global variable `password_history` will be used. `0` means do not enable this feature. Default is 0.

- `PASSWORD_EXPIRE`

Set the expiration time of the current user's password. For example `PASSWORD_EXPIRE INTERVAL 10 DAY` means the password will expire in 10 days. `PASSWORD_EXPIRE NEVER` means that the password does not expire. If set to `PASSWORD_EXPIRE DEFAULT`, the value in the global variable `default_password_lifetime` is used. Defaults to NEVER (or 0), which means it will not expire.

- `FAILED_LOGIN_ATTEMPTS` and `PASSWORD_LOCK_TIME`

When the current user logs in, if the user logs in with the wrong password for n times, the account will be locked, and the lock time is set. For example, `FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 1 DAY` means that if you log in wrongly for 3 times, the account will be locked for one day.

**4. `<comment>`**:Specify the user comment.
> - `PASSWORD_HISTORY`
>
> Whether to allow the current user to use historical passwords when resetting their passwords. For example, `PASSWORD_HISTORY 10` means that it is forbidden to use the password set in the past 10 times as a new password. If set to `PASSWORD_HISTORY DEFAULT`, the value in the global variable `password_history` will be used. `0` means do not enable this feature. Default is 0.
>
> - `PASSWORD_EXPIRE`
>
> Set the expiration time of the current user's password. For example `PASSWORD_EXPIRE INTERVAL 10 DAY` means the password will expire in 10 days. `PASSWORD_EXPIRE NEVER` means that the password does not expire. If set to `PASSWORD_EXPIRE DEFAULT`, the value in the global variable `default_password_lifetime` is used. Defaults to NEVER (or 0), which means it will not expire.
>
> - `FAILED_LOGIN_ATTEMPTS` and `PASSWORD_LOCK_TIME`
>
> When the current user logs in, if the user logs in with the wrong password for n times, the account will be locked, and the lock time is set. For example, `FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 1 DAY` means that if you log in wrongly for 3 times, the account will be locked for one day.
**<comment>**

> Specify the user comment.
## Access Control Requirements

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,9 @@ The `DROP ROLE` statement is used to removes a role.

## Required Parameters

**1. `<role_name>`**:The name of the role.
**<role_name>**

> The name of the role.
## Access Control Requirements

Expand All @@ -48,7 +50,7 @@ The user executing this SQL command must have at least the following privileges:

## Usage Notes

1. Deleting a role does not affect the permissions of users who previously belonged to the role. It is only equivalent to decoupling the role from the user. The permissions that the user has obtained from the role will not change.
- Deleting a role does not affect the permissions of users who previously belonged to the role. It is only equivalent to decoupling the role from the user. The permissions that the user has obtained from the role will not change.

## Example

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,9 @@ The `DROP USER` statement is used to delete a user.

## Required Parameters

**1. `<user_identity>`**:The specified user identity.
**<user_identity>**

> The specified user identity.
## Access Control Requirements

Expand Down
14 changes: 10 additions & 4 deletions docs/sql-manual/sql-statements/account-management/SET-PASSWORD.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,19 @@ SET PASSWORD [FOR <user_identity>] =

## Required Parameters

**1. `<plain_password>`**:The input is a plaintext password.
**<plain_password>**

**2. `<hashed_password>`**:The input is an encrypted password.
> The input is a plaintext password.
**<hashed_password>**

> The input is an encrypted password.
## Optional Parameters

**1. `<user_identity>`**:The user_identity here must exactly match the user_identity specified when creating a user with CREATE USER, otherwise an error will be reported that the user does not exist. If user_identity is not specified, the current user is 'username'@'ip', which may not match any user_identity. Current users can be viewed through SHOW GRANTS.
**<user_identity>**

> The user_identity here must exactly match the user_identity specified when creating a user with CREATE USER, otherwise an error will be reported that the user does not exist. If user_identity is not specified, the current user is 'username'@'ip', which may not match any user_identity. Current users can be viewed through SHOW GRANTS.
## Access Control Requirements

Expand All @@ -55,7 +61,7 @@ The user executing this SQL command must have at least the following privileges:

## Usage Notes

1. If the `FOR user_identity` field does not exist, then change the current user's password.
- If the `FOR user_identity` field does not exist, then change the current user's password.

## Example

Expand Down
22 changes: 11 additions & 11 deletions docs/sql-manual/sql-statements/account-management/SHOW-ROLES.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,17 +36,17 @@ SHOW ROLES

## Return Value

| Column | DataType | Note
|-----------------------|-------------|----
| Name | string | Role Name
| Comment | string | Comment
| Users | string | Included Users
| GlobalPrivs | string | Global Privileges
| CatalogPrivs | string | Catalog Privileges
| DatabasePrivs | string | Database Privileges
| TablePrivs | string | Table Privileges
| ResourcePrivs | string | Resource Privileges
| WorkloadGroupPrivs | string | Workload Group Privileges
| Column | DataType | Note |
|-----------------------|-------------|--------------------------------|
| Name | string | Role Name |
| Comment | string | Comment |
| Users | string | Included Users |
| GlobalPrivs | string | Global Privileges |
| CatalogPrivs | string | Catalog Privileges |
| DatabasePrivs | string | Database Privileges |
| TablePrivs | string | Table Privileges |
| ResourcePrivs | string | Resource Privileges |
| WorkloadGroupPrivs | string | Workload Group Privileges |

## Access Control Requirements

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,13 @@ ALTER ROLE 语句用于修改一个角色的注释

## 必选参数

**1. `<role_name>`**:角色名称。
**<role_name>**

**2. `<comment>`**:注释。
> 指定角色名称。
**<comment>**

> 指定角色注释。
## 权限控制

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -38,17 +38,21 @@ ALTER USER [IF EXISTS] <user_identity> [IDENTIFIED BY <password>]

## 必选参数

**1. `<user_identity>`**:一个用户的唯一标识,语法为:'user_name'@'host'

`user_identity` 由两部分组成,user_name 和 host,其中 username 为用户名。host 标识用户端连接所在的主机地址。host 部分可以使用 % 进行模糊匹配。如果不指定 host,默认为 '%',即表示该用户可以从任意 host 连接到 Doris。host 部分也可指定为 domain,,即使用中括号包围,则 Doris 会认为这个是一个 domain,并尝试解析其 ip 地址。
**<user_identity>**

> 一个用户的唯一标识,语法为:'user_name'@'host'
> `user_identity` 由两部分组成,user_name 和 host,其中 username 为用户名。host 标识用户端连接所在的主机地址。host 部分可以使用 % 进行模糊匹配。如果不指定 host,默认为 '%',即表示该用户可以从任意 host 连接到 Doris。
> host 部分也可指定为 domain,,即使用中括号包围,则 Doris 会认为这个是一个 domain,并尝试解析其 ip 地址。
## 可选参数

**1. `<password>`**:指定用户密码
**<password>**

> 指定用户密码
**2. `<password_policy>`**
**<password_policy>**

用于指定密码认证登录相关策略的子句,目前支持以下策略:
> 用于指定密码认证登录相关策略的子句,目前支持以下策略:
```sql
- PASSWORD_HISTORY [n|DEFAULT]
Expand All @@ -58,24 +62,26 @@ ALTER USER [IF EXISTS] <user_identity> [IDENTIFIED BY <password>]
- ACCOUNT_UNLOCK
```

- `PASSWORD_HISTORY`

是否允许当前用户重置密码时使用历史密码。如 `PASSWORD_HISTORY 10` 表示禁止使用过去 10 次设置过的密码为新密码。如果设置为 `PASSWORD_HISTORY DEFAULT`,则会使用全局变量 `password_history` 中的值。`0` 表示不启用这个功能。默认为 0。

- `PASSWORD_EXPIRE`

设置当前用户密码的过期时间。如 `PASSWORD_EXPIRE INTERVAL 10 DAY` 表示密码会在 10 天后过期。`PASSWORD_EXPIRE NEVER` 表示密码不过期。如果设置为 `PASSWORD_EXPIRE DEFAULT`,则会使用全局变量 `default_password_lifetime` 中的值。默认为 NEVER(或 0),表示不会过期。

- `FAILED_LOGIN_ATTEMPTS``PASSWORD_LOCK_TIME`

设置当前用户登录时,如果使用错误的密码登录 n 次后,账户将被锁定,并设置锁定时间。如 `FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 1 DAY` 表示如果 3 次错误登录,则账户会被锁定一天。
被锁定的账户可以通过 ALTER USER 语句主动解锁。

- `ACCOUNT_UNLOCK`

解锁用户

**3. `<comment>`**:指定用户注释
> - `PASSWORD_HISTORY`
>
> 是否允许当前用户重置密码时使用历史密码。如 `PASSWORD_HISTORY 10` 表示禁止使用过去 10 次设置过的密码为新密码。如果设置为 `PASSWORD_HISTORY DEFAULT`,则会使用全局变量 `password_history` 中的值。`0` 表示不启用这个功能。默认为 0。
>
> - `PASSWORD_EXPIRE`
>
> 设置当前用户密码的过期时间。如 `PASSWORD_EXPIRE INTERVAL 10 DAY` 表示密码会在 10 天后过期。`PASSWORD_EXPIRE NEVER` 表示密码不过期。如果设置为 `PASSWORD_EXPIRE DEFAULT`,则会使用全局变量 `default_password_lifetime` 中的值。默认为 NEVER(或 0),表示不会过期。
>
> - `FAILED_LOGIN_ATTEMPTS``PASSWORD_LOCK_TIME`
>
> 设置当前用户登录时,如果使用错误的密码登录 n 次后,账户将被锁定,并设置锁定时间。如 `FAILED_LOGIN_ATTEMPTS 3 PASSWORD_LOCK_TIME 1 DAY` 表示如果 3 次错误登录,则账户会被锁定一天。
> 被锁定的账户可以通过 ALTER USER 语句主动解锁。
>
> - `ACCOUNT_UNLOCK`
>
> 解锁用户
**<comment>**

> 指定用户注释
## 权限控制

Expand All @@ -88,6 +94,7 @@ ALTER USER [IF EXISTS] <user_identity> [IDENTIFIED BY <password>]
## 注意事项

1. 从 2.0 版本开始,此命令不再支持修改用户角色,相关操作请使用[GRANT](./GRANT.md)[REVOKE](./REVOKE.md)

2. 在一个 ALTER USER 命令中,只能同时对以下账户属性中的一项进行修改:
- 修改密码
- 修改 PASSWORD_HISTORY
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,15 @@ CREATE ROLE 语句用于创建一个无权限的角色,后续可以通过 GRAN

## 必选参数

**1. `<role_name>`**:角色名称。
**<role_name>**

> 指定角色名称。
## 可选参数

**1. `<comment>`**:注释。
**<comment>**

> 指定角色注释。
## 权限控制

Expand Down
Loading

0 comments on commit f556fab

Please sign in to comment.