Skip to content

Database admin can't access its database config #14787

Closed
@pixcc

Description

@pixcc

Steps to reproduce

  1. Deploy cluster with this security_config (also called security_settings in old style cfg):
security_settings:
    default_users:
      - name: root
        password: ""
    default_groups:
      - name: ADMINS
        members:
          - root
    default_access:
      - "+F:root"
      - "+F:ADMINS"

    viewer_allowed_sids:
      - root
      - ADMINS
    monitoring_allowed_sids:
      - root
      - ADMINS
    administration_allowed_sids:
      - root
      - ADMINS

auth:
  domain_login_only: false

features:
  enable_strict_acl_check: true
  database_yaml_config_allowed: true
  enable_strict_user_management: true
  enable_database_admin: true
  1. Create database /Root/db1

  2. Get token for root

ydb -e <endpoint> --user root --no-password -d '/Root' auth get-token -f > root_token
  1. Create database admin group and make it owner of the database
ydb -e <endpoint> --token-file root_token -d '/Root/db1' yql -s '
    CREATE GROUP `dbadmins`;
'

ydb -e <endpoint> --token-file root_token -d '/Root/db1' yql -s '
    CREATE USER `dbadmin1` PASSWORD "1234";
'

ydb -e <endpoint> --token-file root_token -d '/Root/db1' yql -s '
    ALTER GROUP `dbadmins` ADD USER
        `dbadmin1`
'

/ydb -e <endpoint>  --token-file root_token -d '/Root/db1' scheme permissions chown /Root/db1 dbadmins
  1. Get token for dbadmin1
ydb -e <endpoint> --user dbadmin1 -d '/Root/db1' auth get-token -f > dbadmin1_token

Password:
1234
  1. Try to fetch database config
ydb -e <endpoint> --token-file dbadmin1_token -d /Root/db1 admin database config fetch

It returns error:

Status: UNAUTHORIZED
Issues:
<main>: Error: User must have administrator rights

Metadata

Metadata

Assignees

Labels

area/coreYDB Core issuesarea/securitySecurity related features and issuesbugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions