PolarDB:PolarSearch user guide

Dashboard

1. Create a user:

   1. In the left navigation pane, go to Management > Security, select Internal users, and click Create internal user.

   2. Enter the username and password. For example, create a user named testuser with the password USER@test123, and then click Create.

2. Create a role

   1. In the left navigation pane, go to Management > Security, select Roles, and click Create role.

   2. Role permissions include cluster permissions and index permissions. You can add permissions through action groups. In the Index field, specify the index name or use the * wildcard to match a group of indexes. In Index permissions, select the required permissions, such as read-only or read-write.

      Example: Create a role named onlyreadrole that has full cluster permissions (unlimited) and read-only access to all indexes prefixed with indextest.

3. Map the role to a user

   1. In the left navigation pane, go to Management > Security, select Roles, and click the target role.

   2. On the Mapped users tab, add the user mapping. A user can be mapped to multiple roles and inherits the permissions of all mapped roles.

      Example: Map the onlyreadrole role to the testuser user. The testuser user then inherits all permissions of the onlyreadrole role.

REST API

You can manage access control through the REST API. For more information, see OpenSearch API.

1. Create a user

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/internalusers/<new_user>" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "password": "<new_password>",
       "backend_roles": [],
       "attributes": {}
     }'

   Example: Create a user named testuser with the password USER@test123.

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/internalusers/testuser" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "password": "USER@test123",
       "backend_roles": [],
       "attributes": {}
     }'

2. Create a role

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/roles/<role_name>" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "cluster_permissions": ["*"],
       "index_permissions": [
         {
           "index_patterns": ["*"],
           "allowed_actions": ["*"]
         }
       ]
     }'

   • index_patterns: The index name pattern. Use the * wildcard to match multiple indexes.

   • allowed_actions: The permissions to grant, such as read or write.

   Example: Create a role named onlyreadrole that has full cluster permissions and read-only access to all indexes prefixed with indextest.

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/roles/onlyreadrole" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "cluster_permissions": ["*"],
       "index_permissions": [
         {
           "index_patterns": ["indextest*"],
           "allowed_actions": ["read"]
         }
       ]
     }'

3. Map a role

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/rolesmapping/<role_name>" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "backend_roles": [],
       "hosts": [],
       "users": ["<new_user>"]
     }'

   Example: Map the onlyreadrole role to the testuser user. The testuser user then inherits the permissions of the onlyreadrole role.

   curl -X PUT "http://<endpoint>:<port>/_plugins/_security/api/rolesmapping/onlyreadrole" \
     --user "<user_name>:<passwd>" \
     -H "Content-Type: application/json" \
     -d '{
       "backend_roles": [],
       "hosts": [],
       "users": ["testuser"]
     }'