PolarDB:PolarSearch user guide

Dashboard

The admin account must have the security_rest_api_access role. Otherwise, the Security page is not displayed.

1. Create a user In the left navigation pane, go to Management > Security, select Internal users, and click Create internal user. Enter the username and password (for example, username testuser, password USER@test123), then click Create.

   

   

2. Create a role In the left navigation pane, go to Management > Security, select Roles, and click Create role. A role combines cluster permissions and index permissions. In the Index field, specify an index name or use * to match multiple indexes. Under Index permissions, select the required permissions (read-only or read-write). Example: Create a role named onlyreadrole with full cluster permissions and read-only access to all indexes prefixed with indextest.

   

   

3. Map the role to a user In the left navigation pane, go to Management > Security, select Roles, and click the target role. On the Mapped users tab, add the user. A user can be mapped to multiple roles and inherits the permissions of all mapped roles. Example: Map onlyreadrole to testuser. The testuser account then inherits all permissions of onlyreadrole.

   

REST API

All three steps — create a user, create a role, and map the role — follow the same pattern: a PUT request to the _plugins/_security API. For the full API reference, see OpenSearch access control API.

Replace <endpoint>:<port> with your PolarSearch search endpoint, and <user_name>:<passwd> with the admin account credentials.

1. Create a user

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/internalusers/<new_user>" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "password": "<new_password>",
       "backend_roles": [],
       "attributes": {}
     }'

   Example: Create testuser with the password USER@test123.

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/internalusers/testuser" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "password": "USER@test123",
       "backend_roles": [],
       "attributes": {}
     }'

2. Create a role

   • index_patterns: Index name pattern. Use * to match multiple indexes.

   • allowed_actions: Permissions to grant, such as read or write.

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/roles/<role_name>" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "cluster_permissions": ["*"],
       "index_permissions": [
         {
           "index_patterns": ["*"],
           "allowed_actions": ["*"]
         }
       ]
     }'

   Example: Create onlyreadrole with full cluster permissions and read-only access to all indexes prefixed with indextest.

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/roles/onlyreadrole" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "cluster_permissions": ["*"],
       "index_permissions": [
         {
           "index_patterns": ["indextest*"],
           "allowed_actions": ["read"]
         }
       ]
     }'

3. Map a role to a user

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/rolesmapping/<role_name>" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "backend_roles": [],
       "hosts": [],
       "users": ["<new_user>"]
     }'

   Example: Map onlyreadrole to testuser.

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/rolesmapping/onlyreadrole" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "backend_roles": [],
       "hosts": [],
       "users": ["testuser"]
     }'