access_control_improvements
Settings for optional improvements in the access control system.| Setting | Description | Default |
|---|---|---|
enable_read_write_grants | Enables separation of READ and WRITE privileges for external data sources such as S3, HDFS, Kafka, and others. Available starting with version 25.7. When set to true, you can grant READ and WRITE separately for sources instead of a single grant covering both. | false |
on_cluster_queries_require_cluster_grant | Sets whether ON CLUSTER queries require the CLUSTER grant. | true |
role_cache_expiration_time_seconds | Sets the number of seconds since last access, that a role is stored in the Role Cache. | 600 |
select_from_information_schema_requires_grant | Sets whether SELECT * FROM information_schema.<table> requires any grants and can be executed by any user. If set to true, then this query requires GRANT SELECT ON information_schema.<table>, just as for ordinary tables. | true |
select_from_system_db_requires_grant | Sets whether SELECT * FROM system.<table> requires any grants and can be executed by any user. If set to true then this query requires GRANT SELECT ON system.<table> just as for non-system tables. Exceptions: a few system tables (tables, columns, databases, and some constant tables like one, contributors) are still accessible for everyone; and if there is a SHOW privilege (e.g. SHOW USERS) granted then the corresponding system table (i.e. system.users) will be accessible. | true |
settings_constraints_replace_previous | Sets whether a constraint in a settings profile for some setting will cancel actions of the previous constraint (defined in other profiles) for that setting, including fields which are not set by the new constraint. It also enables the changeable_in_readonly constraint type. | true |
table_engines_require_grant | Sets whether creating a table with a specific table engine requires a grant. Not supported in ClickHouse Cloud. | false |
throw_on_unmatched_row_policies | Sets whether reading from a table should throw an exception if the table has row policies, but none of them are for the current user | false |
users_without_row_policies_can_read_rows | Sets whether users without permissive row policies can still read rows using a SELECT query. For example, if there are two users A and B and a row policy is defined only for A, then if this setting is true, user B will see all rows. If this setting is false, user B will see no rows. | true |
<access_control_improvements>
<throw_on_unmatched_row_policies>true</throw_on_unmatched_row_policies>
<users_without_row_policies_can_read_rows>true</users_without_row_policies_can_read_rows>
<on_cluster_queries_require_cluster_grant>true</on_cluster_queries_require_cluster_grant>
<select_from_system_db_requires_grant>true</select_from_system_db_requires_grant>
<select_from_information_schema_requires_grant>true</select_from_information_schema_requires_grant>
<settings_constraints_replace_previous>true</settings_constraints_replace_previous>
<table_engines_require_grant>false</table_engines_require_grant>
<role_cache_expiration_time_seconds>600</role_cache_expiration_time_seconds>
<enable_read_write_grants>false</enable_read_write_grants>
</access_control_improvements>