外观
本页尚未翻译
本页内容仍为英文原文，源自官方文档 governance/principals。中文翻译正在分批进行中。
Principals
Users, groups, and roles: where each comes from, and how a GRANT or REVOKE statement names one.
Applies to: Embedded ❌, Enterprise ✅
A grant names one of three kinds of subject:
| Subject | Where it comes from |
|---|---|
| User (principal) | Your identity provider -- OIDC, Microsoft Entra, Okta, or Keycloak. LanceDB never creates one. |
| Group | Also your identity provider. LanceDB never creates one. |
| Role | LanceDB itself. There is no statement that creates a role -- naming one in a grant is what brings it into existence. |
Naming a subject in SQL
GRANT and REVOKE accept a role, user, or group name directly, with an optional keyword to disambiguate:
sql
GRANT USAGE ON SECRET platform.`model-api-key` TO ROLE research
GRANT USAGE ON SECRET platform.`model-api-key` TO USER alice
GRANT USAGE ON SECRET platform.`model-api-key` TO GROUP `data-science`A USER or GROUP name is resolved against your identity provider, but only after the caller's OWNERSHIP on the object is checked. A name that isn't found, or that matches more than one identity, is an error -- not a silent no-op. ROLE needs no such lookup, since a role is simply whatever name a grant has used.
Name several subjects of the same kind in one statement by omitting the keyword after the first:
sql
GRANT USAGE ON SECRET platform.`model-api-key` TO ROLE etl, rotation_serviceRole membership in SQL
SQL manages which users or groups a role applies to -- its membership -- directly:
sql
GRANT ROLE analysts TO USER alice
GRANT ROLE analysts TO GROUP `data-science`
REVOKE ROLE analysts FROM USER alice
SHOW ROLE BINDINGSChanging membership (GRANT/REVOKE ROLE) needs system OPERATE; SHOW ROLE BINDINGS needs only system USAGE. A role binding accepts a USER or GROUP on the receiving side, never another ROLE -- granting a privilege to a role before anyone is a member of it is still valid; the role simply has no effect until it has members.