权限同步是 NDB 集群用于在 SQL 节点之间共享和同步用户、角色及权限的机制。这可以通过授予 NDB_STORED_USER 权限来启用。有关使用信息，请参阅该权限的描述。Privilege synchronization is the mechanism used by NDB Cluster for sharing and synchronizing users, roles, and privileges between SQL nodes. This can be enabled by granting the NDB_STORED_USER privilege. See the description of the privilege for usage information.

NDB_STORED_USER 会像其他权限一样显示在 SHOW GRANTS 的输出中，如下所示：NDB_STORED_USER is printed in the output of SHOW GRANTS as with any other privilege, as shown here:

mysql> SHOW GRANTS for 'jon'@'localhost';
+---------------------------------------------------+
| Grants for jon@localhost                          |
+---------------------------------------------------+
| GRANT USAGE ON *.* TO `jon`@`localhost`           |
| GRANT NDB_STORED_USER ON *.* TO `jon`@`localhost` |
+---------------------------------------------------+

您还可以使用 NDB Cluster 提供的 ndb_select_all 工具验证此账户的权限是否被共享，如下所示（部分输出为了保留格式而换行）：You can also verify that privileges are shared for this account using the ndb_select_all utility supplied with NDB Cluster, like this (some output wrapped to preserve formatting):

$> ndb_select_all -d mysql ndb_sql_metadata | grep '`jon`@`localhost`'
12      "'jon'@'localhost'"     0       [NULL]  "GRANT USAGE ON *.* TO `jon`@`localhost`"
11      "'jon'@'localhost'"     0       2       "CREATE USER `jon`@`localhost`
IDENTIFIED WITH 'caching_sha2_password' AS
0x2441243030352466014340225A107D590E6E653B5D587922306102716D752E6656772F3038512F
6C5072776D30376D37347A384B557A4C564F70495158656A31382E45324E33
REQUIRE NONE PASSWORD EXPIRE DEFAULT ACCOUNT UNLOCK PASSWORD HISTORY DEFAULT
PASSWORD REUSE INTERVAL DEFAULT PASSWORD REQUIRE CURRENT DEFAULT"
12      "'jon'@'localhost'"     1       [NULL]  "GRANT NDB_STORED_USER ON *.* TO `jon`@`localhost`"

ndb_sql_metadata 是一个特殊的 NDB 表，无法通过 mysql 或其他 MySQL 客户端查看。ndb_sql_metadata is a special NDB table that is not visible using the mysql or other MySQL client.

授予 NDB_STORED_USER 特权的语句，例如 GRANT NDB_STORED_USER ON *.* TO 'cluster_app_user'@'localhost'，的工作原理是指示 NDB 使用查询 SHOW CREATE USER cluster_app_user@localhost 和 SHOW GRANTS FOR cluster_app_user@localhost 创建快照，然后将结果存储在 ndb_sql_metadata 中。随后，其他 SQL 节点会被请求读取并应用该快照。每当 MySQL 服务器启动并作为 SQL 节点加入集群时，它会在集群模式同步过程中执行这些存储的 CREATE USER 和 GRANT 语句。A statement granting the NDB_STORED_USER privilege, such as GRANT NDB_STORED_USER ON *.* TO 'cluster_app_user'@'localhost', works by directing NDB to create a snapshot using the queries SHOW CREATE USER cluster_app_user@localhost and SHOW GRANTS FOR cluster_app_user@localhost, then storing the results in ndb_sql_metadata. Any other SQL nodes are then requested to read and apply the snapshot. Whenever a MySQL server starts up and joins the cluster as an SQL node it executes these stored CREATE USER and GRANT statements as part of the cluster schema synchronization process.

每当在一个 SQL 节点上执行 SQL 语句，而该节点并非语句发起的节点时，该语句会在 NDBCLUSTER 存储引擎的一个工具线程中运行；这是在一个与 MySQL 复制副本应用线程相当的安全环境内进行的。Whenever an SQL statement is executed on an SQL node other than the one where it originated, the statement is run in a utility thread of the NDBCLUSTER storage engine; this is done within a security environment equivalent to that of the MySQL replication replica applier thread.

执行用户权限更改的 SQL 节点在进行操作前会先获取全局锁，这可以防止不同 SQL 节点上并发的 ACL 操作导致死锁。An SQL node performing a change to user privileges takes a global lock before doing so, which prevents deadlocks by concurrent ACL operations on different SQL nodes.

您应该记住，由于共享模式更改操作是同步执行的，因此在对任何共享用户或用户进行更改之后的下一次共享模式更改将作为一个同步点。任何待处理的用户更改在模式更改分发开始之前都会完成；之后，模式更改本身会同步运行。例如，如果在分布式用户的DROP USER之后紧跟一条DROP DATABASE语句，则数据库的删除必须等到在所有 SQL 节点上用户删除完成之后才能执行。You should keep in mind that, because shared schema change operations are performed synchronously, the next shared schema change following a change to any shared user or users serves as a synchronization point. Any pending user changes run to completion before the schema change distribution can begin; after this the schema change itself runs synchronously. For example, if a DROP DATABASE statement follows a DROP USER of a distributed user, the drop of the database cannot take place until the drop of the user has completed on all SQL nodes.

如果来自多个 SQL 节点的多个 GRANT、REVOKE 或其他用户管理语句导致某个用户在不同 SQL 节点上的权限不一致，可以通过在权限正确的 SQL 节点上为该用户执行 GRANT NDB_STORED_USER 来修复此问题；这会创建权限的新快照并同步到其他 SQL 节点。In the event that multiple GRANT, REVOKE, or other user administration statements from multiple SQL nodes cause privileges for a given user to diverge on different SQL nodes, you can fix this problem by issuing GRANT NDB_STORED_USER for this user on an SQL node where the privileges are known to be correct; this causes a new snapshot of the privileges to be taken and synchronized to the other SQL nodes.