|
1 | 1 | --- |
2 | 2 | title: SQL Proxy Account |
3 | | -summary: Learn about the SQL proxy account in TiDB Cloud. |
| 3 | +summary: 了解 TiDB Cloud 中的 SQL 代理账号。 |
4 | 4 | --- |
5 | 5 |
|
6 | | -# SQL Proxy Account |
| 6 | +# SQL 代理账号 <!-- translated by AI --> |
7 | 7 |
|
8 | | -A SQL proxy account is a SQL user account that is automatically created by TiDB Cloud to access the database via [SQL Editor](/ai/explore-data-with-chat2query.md) or [Data Service](https://docs.pingcap.com/tidbcloud/api/v1beta1/dataservice) on behalf of a TiDB Cloud user. For example, `testuser@pingcap.com` is a TiDB Cloud user account, while `3jhEcSimm7keKP8.testuser._41mqK6H4` is its corresponding SQL proxy account. |
| 8 | +SQL 代理账号是 TiDB Cloud 自动为 TiDB Cloud 用户创建的 SQL 用户账号,用于通过 [SQL Editor](/ai/explore-data-with-chat2query.md) 或 [Data Service](https://docs.pingcap.com/tidbcloud/api/v1beta1/dataservice) 代表用户访问数据库。例如,`testuser@pingcap.com` 是一个 TiDB Cloud 用户账号,而 `3jhEcSimm7keKP8.testuser._41mqK6H4` 则是其对应的 SQL 代理账号。 |
9 | 9 |
|
10 | | -SQL proxy accounts provide a secure, token-based authentication mechanism for accessing the database in TiDB Cloud. By eliminating the need for traditional username and password credentials, SQL proxy accounts enhance security and simplify access management. |
| 10 | +SQL 代理账号为在 TiDB Cloud 中访问数据库提供了一种安全的、基于令牌的身份验证机制。通过消除传统的用户名和密码凭证,SQL 代理账号提升了安全性并简化了访问管理。 |
11 | 11 |
|
12 | | -The key benefits of SQL proxy accounts are as follows: |
| 12 | +SQL 代理账号的主要优势如下: |
13 | 13 |
|
14 | | -- Enhanced security: mitigates risks associated with static credentials by using JWT tokens. |
15 | | -- Streamlined access: restricts access specifically to the SQL Editor and Data Service, ensuring precise control. |
16 | | -- Ease of management: simplifies authentication for developers and administrators working with TiDB Cloud. |
| 14 | +- 增强安全性:通过使用 JWT 令牌,降低了与静态凭证相关的风险。 |
| 15 | +- 精简访问控制:仅限于 SQL Editor 和 Data Service 访问,确保精确的权限管理。 |
| 16 | +- 易于管理:为开发者和管理员简化了 TiDB Cloud 的身份验证流程。 |
17 | 17 |
|
18 | | -## Identify the SQL proxy account |
| 18 | +## 识别 SQL 代理账号 |
19 | 19 |
|
20 | | -If you want to identify whether a specific SQL account is a SQL proxy account, take the following steps: |
| 20 | +如果你想判断某个 SQL 账号是否为 SQL 代理账号,请按照以下步骤操作: |
21 | 21 |
|
22 | | -1. Examine the `mysql.user` table: |
| 22 | +1. 检查 `mysql.user` 表: |
23 | 23 |
|
24 | 24 | ```sql |
25 | 25 | USE mysql; |
26 | 26 | SELECT user FROM user WHERE plugin = 'tidb_auth_token'; |
27 | 27 | ``` |
28 | 28 |
|
29 | | -2. Check grants for the SQL account. If roles like `role_admin`, `role_readonly`, or `role_readwrite` are listed, then it is a SQL proxy account. |
| 29 | +2. 检查该 SQL 账号的授权信息。如果授权中包含 `role_admin`、`role_readonly` 或 `role_readwrite` 等角色,则该账号为 SQL 代理账号。 |
30 | 30 |
|
31 | 31 | ```sql |
32 | 32 | SHOW GRANTS for 'username'; |
33 | 33 | ``` |
34 | 34 |
|
35 | | -## How the SQL proxy account is created |
| 35 | +## SQL 代理账号的创建方式 |
36 | 36 |
|
37 | | -The SQL proxy account is automatically created during TiDB Cloud cluster initialization for the TiDB Cloud user who is granted a role with permissions in the cluster. |
| 37 | +当 TiDB Cloud 用户被授予集群权限角色时,SQL 代理账号会在 TiDB Cloud 集群初始化期间自动创建。 |
38 | 38 |
|
39 | | -## How the SQL proxy account is deleted |
| 39 | +## SQL 代理账号的删除方式 |
40 | 40 |
|
41 | | -When a user is removed from [an organization](/tidb-cloud/manage-user-access.md#remove-an-organization-member) or [a project](/tidb-cloud/manage-user-access.md#remove-a-project-member), or their role changes to one that does not have access to the cluster, the SQL proxy account is automatically deleted. |
| 41 | +当用户被移出 [组织](/tidb-cloud/manage-user-access.md#remove-an-organization-member) 或 [项目](/tidb-cloud/manage-user-access.md#remove-a-project-member),或者其角色变更为无权访问集群的角色时,SQL 代理账号会被自动删除。 |
42 | 42 |
|
43 | | -Note that if a SQL proxy account is manually deleted, it will be automatically recreated when the user log in to the TiDB Cloud console next time. |
| 43 | +需要注意的是,如果 SQL 代理账号被手动删除,当用户下次登录 TiDB Cloud 控制台时,该账号会被自动重新创建。 |
44 | 44 |
|
45 | | -## SQL proxy account username |
| 45 | +## SQL 代理账号用户名 |
46 | 46 |
|
47 | | -In some cases, the SQL proxy account username is exactly the same as the TiDB Cloud username, but in other cases it is not exactly the same. The SQL proxy account username is determined by the length of the TiDB Cloud user's email address. The rules are as follows: |
| 47 | +在某些情况下,SQL 代理账号的用户名与 TiDB Cloud 用户名完全相同,但在其他情况下则不完全相同。SQL 代理账号的用户名由 TiDB Cloud 用户邮箱地址的长度决定,规则如下: |
48 | 48 |
|
49 | | -| Environment | Email length | Username format | |
| 49 | +| 环境 | 邮箱长度 | 用户名格式 | |
50 | 50 | | ----------- | ------------ | --------------- | |
51 | | -| TiDB Cloud Dedicated | <= 32 characters | Full email address | |
52 | | -| TiDB Cloud Dedicated | > 32 characters | `prefix($email, 23)_prefix(base58(sha1($email)), 8)` | |
53 | | -| {{{ .starter }}} | <= 15 characters | `serverless_unique_prefix + "." + email` | |
54 | | -| {{{ .starter }}} | > 15 characters | `serverless_unique_prefix + "." + prefix($email, 6)_prefix(base58(sha1($email)), 8)` | |
| 51 | +| TiDB Cloud Dedicated | <= 32 个字符 | 完整邮箱地址 | |
| 52 | +| TiDB Cloud Dedicated | > 32 个字符 | `prefix($email, 23)_prefix(base58(sha1($email)), 8)` | |
| 53 | +| TiDB Cloud Serverless | <= 15 个字符 | `serverless_unique_prefix + "." + email` | |
| 54 | +| TiDB Cloud Serverless | > 15 个字符 | `serverless_unique_prefix + "." + prefix($email, 6)_prefix(base58(sha1($email)), 8)` | |
55 | 55 |
|
56 | | -Examples: |
| 56 | +示例: |
57 | 57 |
|
58 | | -| Environment | Email address | SQL proxy account username | |
| 58 | +| 环境 | 邮箱地址 | SQL 代理账号用户名 | |
59 | 59 | | ----------- | ----- | -------- | |
60 | 60 | | TiDB Cloud Dedicated | `user@pingcap.com` | `user@pingcap.com` | |
61 | 61 | | TiDB Cloud Dedicated | `longemailaddressexample@pingcap.com` | `longemailaddressexample_48k1jwL9` | |
62 | | -| {{{ .starter }}} | `u1@pingcap.com` | `{user_name_prefix}.u1@pingcap.com` | |
63 | | -| {{{ .starter }}} | `longemailaddressexample@pingcap.com` | `{user_name_prefix}.longem_48k1jwL9`| |
| 62 | +| TiDB Cloud Serverless | `u1@pingcap.com` | `{user_name_prefix}.u1@pingcap.com` | |
| 63 | +| TiDB Cloud Serverless | `longemailaddressexample@pingcap.com` | `{user_name_prefix}.longem_48k1jwL9`| |
64 | 64 |
|
65 | 65 | > **Note:** |
66 | 66 | > |
67 | | -> In the preceding table, `{user_name_prefix}` is a unique prefix generated by TiDB Cloud to distinguish {{{ .starter }}} clusters. For details, see the [user name prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) of {{{ .starter }}} clusters. |
| 67 | +> 在上表中,`{user_name_prefix}` 是 TiDB Cloud 为区分 TiDB Cloud Serverless 集群而生成的唯一前缀。详情请参见 TiDB Cloud Serverless 集群的 [user name prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix)。 |
68 | 68 |
|
69 | | -## SQL proxy account password |
| 69 | +## SQL 代理账号密码 |
70 | 70 |
|
71 | | -Since SQL proxy accounts are JWT token-based, it is not necessary to manage passwords for these accounts. The security token is automatically managed by the system. |
| 71 | +由于 SQL 代理账号基于 JWT 令牌,因此无需为这些账号管理密码。安全令牌由系统自动管理。 |
72 | 72 |
|
73 | | -## SQL proxy account roles |
| 73 | +## SQL 代理账号角色 |
74 | 74 |
|
75 | | -The SQL proxy account's role depends on the TiDB Cloud user's IAM role: |
| 75 | +SQL 代理账号的角色取决于 TiDB Cloud 用户的 IAM 角色: |
76 | 76 |
|
77 | | -- Organization level: |
| 77 | +- 组织级别: |
78 | 78 | - Organization Owner: role_admin |
79 | | - - Organization Billing Manager: No proxy account |
80 | | - - Organization Viewer: No proxy account |
81 | | - - Organization Console Audit Manager: No proxy account |
| 79 | + - Organization Billing Manager: 无代理账号 |
| 80 | + - Organization Viewer: 无代理账号 |
| 81 | + - Organization Console Audit Manager: 无代理账号 |
82 | 82 |
|
83 | | -- Project level: |
| 83 | +- 项目级别: |
84 | 84 | - Project Owner: role_admin |
85 | 85 | - Project Data Access Read-Write: role_readwrite |
86 | 86 | - Project Data Access Read-Only: role_readonly |
87 | 87 |
|
88 | | -## SQL proxy account access control |
| 88 | +## SQL 代理账号访问控制 |
89 | 89 |
|
90 | | -SQL proxy accounts are JWT token-based and only accessible to the Data Service and SQL Editor. It is impossible to access the TiDB Cloud cluster using a SQL proxy account with a username and password. |
| 90 | +SQL 代理账号基于 JWT 令牌,仅可用于 Data Service 和 SQL Editor 访问。无法通过用户名和密码使用 SQL 代理账号访问 TiDB Cloud 集群。 |
0 commit comments