The GRANT statement allows granting any RBAC roles to a specific user.
Roles can be of the following two types:
Roles which apply generically to all keyspaces or resources in the cluster.
- parameterized by a keyspace
Roles which are defined for the scope of the specified keyspace only. The keyspace name is specified after ON.
DataReader ON `travel-sample`
Query_Select ON `travel-sample`
|Only Full Administrators can run the GRANT statement. For more details about user roles, see Authorization.|
grant ::= 'GRANT' role ( ',' role )* ( 'ON' keyspace-ref ( ',' keyspace-ref )* )? 'TO' user ( ',' user )*
One of the RBAC role names predefined by Couchbase Server.
The following roles have short forms that can be used as well:
A user name created by the Couchbase Server RBAC system.
keyspace-ref ::= keyspace-path | keyspace-partial
keyspace-path ::= ( namespace ':' )? bucket ( '.' scope '.' collection )?
keyspace-partial ::= collection
The simple name or fully-qualified name of a keyspace. Refer to the CREATE INDEX statement for details of the syntax.
GRANT statements support legacy systems and have two forms:
GRANT Replication Admin, Query External Access TO cchaplan, jgleason; GRANT replication_admin, query_external_access TO cchaplan, jgleason;
GRANT Query Select, Views Admin ON orders, customers TO bill, linda; GRANT query_select, views_admin ON orders, customers TO bill, linda;
|Mixing of parameterized and unparameterized roles or syntax is not allowed and will create an error.|