Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

adapter: Prevent login to mz_system externally #14093

Merged
merged 14 commits into from
Aug 15, 2022
Merged

adapter: Prevent login to mz_system externally #14093

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
1c8a30c
mz_system is the system user that is responsible for executing commands
jkosh44 Aug 8, 2022
330430e
Clean up code
jkosh44 Aug 11, 2022
8c30970
Change method name
jkosh44 Aug 11, 2022
80826de
Fix auth logic
jkosh44 Aug 12, 2022
4230a90
Remove http builtin role
jkosh44 Aug 12, 2022
48848ec
Move auth out of the adapter crate
jkosh44 Aug 12, 2022
53935c6
Fix tests
jkosh44 Aug 12, 2022
d05f40f
Fix tests
jkosh44 Aug 12, 2022
9eff207
Add error for missing username
jkosh44 Aug 15, 2022
799d2c0
Merge branch 'main' of github.com:MaterializeInc/materialize into mz-…
jkosh44 Aug 15, 2022
e087c15
Fix merge conflict
jkosh44 Aug 15, 2022
eb23b31
Fix create user logic
jkosh44 Aug 15, 2022
dbf4f15
Clean up imports and fix test
jkosh44 Aug 15, 2022
a1e5ace
Add tests for system user
jkosh44 Aug 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Clean up imports and fix test
  • Loading branch information
@jkosh44
jkosh44 committed Aug 15, 2022
commit dbf4f1593b30d27f3776d9a090b69841f85039d8
2 changes: 1 addition & 1 deletion src/environmentd/src/http.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@ use http::header::{AUTHORIZATION, CONTENT_TYPE};
use http::{Request, StatusCode};
use hyper::server::conn::AddrIncoming;
use hyper_openssl::MaybeHttpsStream;
use mz_adapter::catalog::HTTP_DEFAULT_USER;
use openssl::nid::Nid;
use openssl::ssl::{Ssl, SslContext};
use openssl::x509::X509;
Expand All @@ -45,6 +44,7 @@ use tokio_openssl::SslStream;
use tower_http::cors::{AllowOrigin, Any, CorsLayer};
use tracing::{error, warn};

use mz_adapter::catalog::HTTP_DEFAULT_USER;
use mz_adapter::session::Session;
use mz_adapter::SessionClient;
use mz_frontegg_auth::{FronteggAuthentication, FronteggError};
Expand Down
3 changes: 1 addition & 2 deletions test/testdrive/roles.td
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
# by the Apache License, Version 2.0.

$ set-sql-timeout duration=1s
$ set-regex match=u\d{1,2} replacement=<RID>

# Verify initial roles.
> SELECT id, name FROM mz_roles
Expand All @@ -24,8 +25,6 @@ contains:conflicting or redundant options
! CREATE ROLE foo LOGIN NOLOGIN SUPERUSER
contains:conflicting or redundant options

$ set-regex match=u\d{1,2} replacement=<RID>

# Create roles using both syntaxes and verify their existence.
> CREATE ROLE rj LOGIN SUPERUSER
> CREATE USER fms SUPERUSER
Expand Down