Skip to content

Commit ccada6f

Browse files
zvonandzvonand
authored
Merge branch 'customizations/24.8.14' into backports/customizations/24.8.14/72226
2 parents 3b179cb + 4d0cb82 commit ccada6f

File tree

66 files changed

+1337
-527
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+1337
-527
lines changed

‎.github/workflows/release_branches.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -552,7 +552,7 @@ jobs:
552552
secrets: inherit
553553
with:
554554
runner_type: altinity-on-demand, altinity-regression-tester
555-
commit: fc19ce3a7322a10ab791de755c950a56744a12e7
555+
commit: b72ac10337ea9d7a0f764b86a40f4bb7dc0f81ff
556556
arch: release
557557
build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
558558
timeout_minutes: 300
@@ -563,7 +563,7 @@ jobs:
563563
secrets: inherit
564564
with:
565565
runner_type: altinity-on-demand, altinity-regression-tester-aarch64
566-
commit: fc19ce3a7322a10ab791de755c950a56744a12e7
566+
commit: b72ac10337ea9d7a0f764b86a40f4bb7dc0f81ff
567567
arch: aarch64
568568
build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
569569
timeout_minutes: 300

‎docs/en/operations/server-configuration-parameters/settings.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3121,3 +3121,15 @@ Default value: "default"
31213121

31223122
**See Also**
31233123
- [Workload Scheduling](/docs/en/operations/workload-scheduling.md)
3124+
3125+
## max_authentication_methods_per_user {#max_authentication_methods_per_user}
3126+
3127+
The maximum number of authentication methods a user can be created with or altered to.
3128+
Changing this setting does not affect existing users. Create/alter authentication-related queries will fail if they exceed the limit specified in this setting.
3129+
Non authentication create/alter queries will succeed.
3130+
3131+
Type: UInt64
3132+
3133+
Default value: 100
3134+
3135+
Zero means unlimited

‎docs/en/sql-reference/statements/alter/user.md‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,10 @@ Syntax:
1212
``` sql
1313
ALTER USER [IF EXISTS] name1 [ON CLUSTER cluster_name1] [RENAME TO new_name1]
1414
[, name2 [ON CLUSTER cluster_name2] [RENAME TO new_name2] ...]
15-
[NOT IDENTIFIED | IDENTIFIED {[WITH {no_password | plaintext_password | sha256_password | sha256_hash | double_sha1_password | double_sha1_hash}] BY {'password' | 'hash'}} | {WITH ldap SERVER 'server_name'} | {WITH kerberos [REALM 'realm']} | {WITH ssl_certificate CN 'common_name' | SAN 'TYPE:subject_alt_name'}]
15+
[NOT IDENTIFIED | IDENTIFIED | ADD IDENTIFIED {[WITH {no_password | plaintext_password | sha256_password | sha256_hash | double_sha1_password | double_sha1_hash}] BY {'password' | 'hash'}} | {WITH ldap SERVER 'server_name'} | {WITH kerberos [REALM 'realm']} | {WITH ssl_certificate CN 'common_name' | SAN 'TYPE:subject_alt_name'}]
1616
[[ADD | DROP] HOST {LOCAL | NAME 'name' | REGEXP 'name_regexp' | IP 'address' | LIKE 'pattern'} [,...] | ANY | NONE]
1717
[VALID UNTIL datetime]
18+
[RESET AUTHENTICATION METHODS TO NEW]
1819
[DEFAULT ROLE role [,...] | ALL | ALL EXCEPT role [,...] ]
1920
[GRANTEES {user | role | ANY | NONE} [,...] [EXCEPT {user | role} [,...]]]
2021
[SETTINGS variable [= value] [MIN [=] min_value] [MAX [=] max_value] [READONLY | WRITABLE] | PROFILE 'profile_name'] [,...]
@@ -62,3 +63,31 @@ Allows the user with `john` account to grant his privileges to the user with `ja
6263
``` sql
6364
ALTER USER john GRANTEES jack;
6465
```
66+
67+
Adds new authentication methods to the user while keeping the existing ones:
68+
69+
``` sql
70+
ALTER USER user1 ADD IDENTIFIED WITH plaintext_password by '1', bcrypt_password by '2', plaintext_password by '3'
71+
```
72+
73+
Notes:
74+
1. Older versions of ClickHouse might not support the syntax of multiple authentication methods. Therefore, if the ClickHouse server contains such users and is downgraded to a version that does not support it, such users will become unusable and some user related operations will be broken. In order to downgrade gracefully, one must set all users to contain a single authentication method prior to downgrading. Alternatively, if the server was downgraded without the proper procedure, the faulty users should be dropped.
75+
2. `no_password` can not co-exist with other authentication methods for security reasons.
76+
Because of that, it is not possible to `ADD` a `no_password` authentication method. The below query will throw an error:
77+
78+
``` sql
79+
ALTER USER user1 ADD IDENTIFIED WITH no_password
80+
```
81+
82+
If you want to drop authentication methods for a user and rely on `no_password`, you must specify in the below replacing form.
83+
84+
Reset authentication methods and adds the ones specified in the query (effect of leading IDENTIFIED without the ADD keyword):
85+
86+
``` sql
87+
ALTER USER user1 IDENTIFIED WITH plaintext_password by '1', bcrypt_password by '2', plaintext_password by '3'
88+
```
89+
90+
Reset authentication methods and keep the most recent added one:
91+
``` sql
92+
ALTER USER user1 RESET AUTHENTICATION METHODS TO NEW
93+
```

‎docs/en/sql-reference/statements/create/user.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ CREATE USER [IF NOT EXISTS | OR REPLACE] name1 [ON CLUSTER cluster_name1]
1515
[NOT IDENTIFIED | IDENTIFIED {[WITH {no_password | plaintext_password | sha256_password | sha256_hash | double_sha1_password | double_sha1_hash}] BY {'password' | 'hash'}} | {WITH ldap SERVER 'server_name'} | {WITH kerberos [REALM 'realm']} | {WITH ssl_certificate CN 'common_name' | SAN 'TYPE:subject_alt_name'} | {WITH ssh_key BY KEY 'public_key' TYPE 'ssh-rsa|...'} | {WITH http SERVER 'server_name' [SCHEME 'Basic']}]
1616
[HOST {LOCAL | NAME 'name' | REGEXP 'name_regexp' | IP 'address' | LIKE 'pattern'} [,...] | ANY | NONE]
1717
[VALID UNTIL datetime]
18+
[RESET AUTHENTICATION METHODS TO NEW]
1819
[IN access_storage_type]
1920
[DEFAULT ROLE role [,...]]
2021
[DEFAULT DATABASE database | NONE]
@@ -144,6 +145,17 @@ In ClickHouse Cloud, by default, passwords must meet the following complexity re
144145
145146
The available password types are: `plaintext_password`, `sha256_password`, `double_sha1_password`.
146147
148+
7. Multiple authentication methods can be specified:
149+
150+
```sql
151+
CREATE USER user1 IDENTIFIED WITH plaintext_password by '1', bcrypt_password by '2', plaintext_password by '3''
152+
```
153+
154+
Notes:
155+
1. Older versions of ClickHouse might not support the syntax of multiple authentication methods. Therefore, if the ClickHouse server contains such users and is downgraded to a version that does not support it, such users will become unusable and some user related operations will be broken. In order to downgrade gracefully, one must set all users to contain a single authentication method prior to downgrading. Alternatively, if the server was downgraded without the proper procedure, the faulty users should be dropped.
156+
2. `no_password` can not co-exist with other authentication methods for security reasons. Therefore, you can only specify
157+
`no_password` if it is the only authentication method in the query.
158+
147159
## User Host
148160

149161
User host is a host from which a connection to ClickHouse server could be established. The host can be specified in the `HOST` query section in the following ways:

‎src/Access/AccessEntityIO.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ AccessEntityPtr deserializeAccessEntityImpl(const String & definition)
8282
if (res)
8383
throw Exception(ErrorCodes::INCORRECT_ACCESS_ENTITY_DEFINITION, "Two access entities attached in the same file");
8484
res = user = std::make_unique<User>();
85-
InterpreterCreateUserQuery::updateUserFromQuery(*user, *create_user_query, /* allow_no_password = */ true, /* allow_plaintext_password = */ true);
85+
InterpreterCreateUserQuery::updateUserFromQuery(*user, *create_user_query, /* allow_no_password = */ true, /* allow_plaintext_password = */ true, /* max_number_of_authentication_methods = zero is unlimited*/ 0);
8686
}
8787
else if (auto * create_role_query = query->as<ASTCreateRoleQuery>())
8888
{

0 commit comments

Comments
 (0)