Lindorm:User and permission management

lindorm-cli

lindorm-cli -url <Endpoint for LindormTSDB SQL> -username <Username> -password <Password> -database <Database name>

For details, see Use Lindorm-cli to connect to and use LindormTSDB.

JDBC

String url = "<Endpoint for LindormTSDB SQL>";
String username = "<Username>";
String password = "<Password>";
Connection conn = null;

try {
    conn = DriverManager.getConnection(url, username, password);
    // Perform operations after the client is connected to LindormTSDB.
} catch (SQLException e) {
    e.printStackTrace();
}

For details, see Tutorial: Use the JDBC driver for Lindorm to connect to and use LindormTSDB.

Druid connection pool

dataSource.setDriver(DriverManager.getDriver("<Endpoint for LindormTSDB SQL>"))
dataSource.setUrl("<Endpoint for LindormTSDB SQL>")
dataSource.setUsername("<Username>")
dataSource.setPassword("<Password>")

For details, see Tutorial: Use the Druid connection pool to connect to LindormTSDB.

HTTP API

Applications that use OpenTSDB-compatible HTTP API operations must include credentials in the Authorization header as a Base64-encoded string.

The following example constructs the authorization header and sends a SQL request:

import base64
import requests

url      = "<HTTP Endpoint for LindormTSDB>/api/v2/sql"
username = "<Username>"
password = "<Password>"

# Encode credentials as Base64
credentials = base64.b64encode(f"{username}:{password}".encode()).decode()

headers = {
    "Content-Type": "text/plain",
    "Authorization": f"Basic {credentials}"
}

response = requests.post(url, headers=headers, data="SELECT * FROM my_table LIMIT 10")
print(response.json())

For applications using TSDB SDKs, pass credentials via the basicAuth method when creating a TSDBConfig object.

For the full authentication specification, see Specify user credentials for authentication. For request format details, see Request content.

Permission types

LindormTSDB defines four permission types:

A user's effective permissions are the union of all granted permissions. For example, a user with GLOBAL READ and DATABASE READ on DB1 can query data across all databases.

Permission scopes

Permissions are granted at one of two scopes:

• GLOBAL — Applies to all databases and tables in the instance. A user with GLOBAL READ can query any time series table in any database.

• DATABASE — Applies to all tables within a specific database. A user with READ on DB1 can query any time series table in DB1.

Authorization rules

• The SYSTEM permission scope is always GLOBAL. It cannot be scoped to a single database.

• Only users with GLOBAL ADMIN or SYSTEM permissions can create, delete, modify, or authorize users.

Use SQL

Use the following SQL statements to manage users and permissions:

Use the cluster management system

User and permission data are shared between LindormTSDB and LindormTable. If LindormTable is activated, log on to the LindormTable cluster management system to manage users and permissions. For details, see Log on to the cluster management system.

Permissions required for SQL statements

The following table lists the permissions required to run common SQL statements. To find the permissions needed for a specific statement, locate the statement row and check which columns are marked ○.

○ = required, × = not required.

Permissions required for OpenTSDB-compatible HTTP API operations

All OpenTSDB-compatible HTTP API operations require GLOBAL-scope permissions. ○ = required, × = not required.