修改用户默认workload_group后stream_load报错

Viewed 59

用户:'xxx'@'192.168.%'
新建了一个workload_group:bigdata,将这个用户默认group改成了bigdata
该用户发起stream_load的时候报错: [ANALYSIS_ERROR]TStatus: errCode = 2, detailMessage = Access denied; you need (at least one of) the USAGE/ADMIN p rivilege(s) to use workload group 'bigdata'. User: 'xxx'@'%'

该用户没有授权过'%'这个identity,AI推测是doris拿不到Client的IP,但是审计里是有ClientIp字段的,且用户具有这个workload group的权限,mysql连接可以正常执行

新建了个新账号测试复现问题:

create user 'test_stream_load'@'192.168.%' identified by 'Doris@123';

grant spark_role to 'test_stream_load'@'192.168.%';

SET PROPERTY FOR 'test_stream_load' 'default_workload_group' = 'bigdata';
GRANT USAGE_PRIV ON WORKLOAD GROUP 'bigdata' TO 'test_stream_load'@'192.168.%';

CREATE TABLE testdb.test_streamload(
    user_id  BIGINT  NOT NULL,
    name     VARCHAR(20),
    age      INT
)
DUPLICATE KEY(user_id)
DISTRIBUTED BY HASH(user_id) BUCKETS 1;

stream load请求

curl --location-trusted -u test_stream_load:Doris@123 \
    -H "Expect:100-continue" \
    -H "column_separator:," \
    -H "columns:user_id,name,age" \
    -T test.csv \
    -XPUT http://192.168.11.30:18030/api/testdb/test_streamload/_stream_load

最后报错响应

{
    "TxnId": 30168856,
    "Label": "cc88c955-9b31-4c85-9ff5-0395973f1e6b",
    "Comment": "",
    "TwoPhaseCommit": "false",
    "Status": "Fail",
    "Message": "[ANALYSIS_ERROR]TStatus: errCode = 2, detailMessage = Access denied; you need (at least one of) the USAGE/ADMIN privilege(s) to use workload group 'bigdata'. User: 'test_stream_load'@'%'",
    "NumberTotalRows": 0,
    "NumberLoadedRows": 0,
    "NumberFilteredRows": 0,
    "NumberUnselectedRows": 0,
    "LoadBytes": 0,
    "LoadTimeMs": 0,
    "BeginTxnTimeMs": 0,
    "StreamLoadPutTimeMs": 0,
    "ReadDataTimeMs": 0,
    "WriteDataTimeMs": 0,
    "ReceiveDataTimeMs": 0,
    "CommitAndPublishTimeMs": 0
}

查看workload group权限

Name Value
GRANTEE 'test_stream_load'@'192.168.%'
WORKLOAD_GROUP_NAME bigdata
PRIVILEGE_TYPE Usage_priv
IS_GRANTABLE NO
1 Answers
  1. 执行 SHOW GRANTS FOR 'xxx'@'%'; 查看当时授权用的 identity 。
  2. 查询系统表 workload_group_privileges ,SELECT * FROM information_schema.workload_group_privileges WHERE GRANTEE LIKE '%xxx%';,核对 WORKLOAD_GROUP_NAME 字段是否精确等于 bigdata。
  3. 确认报错中的 User: 'xxx'@'%' 与你 GRANT 时使用的用户 host 部分完全一致。