Skip to content
Snippets Groups Projects
  • Vladislav Shpilevoy's avatar
    b53bd593
    access: update credentials without reconnect · b53bd593
    Vladislav Shpilevoy authored
    Credentials is a cache of user universal privileges. And that
    cache can become outdated in case user privs were changed after
    creation of the cache.
    
    The patch makes user update all its credentials caches with new
    privileges, via a list of all creds.
    
    That solves a couple of real life problems:
    
    - If a user managed to connect after box.cfg started listening
    port, but before access was granted, then he needed a reconnect;
    
    - Even if access was granted, a user may connect after box.cfg
    listen, but before access *is recovered* from _priv space. It
    was not possible to fix without a reconnect. And this problem
    affected replication.
    
    Closes #2763
    Part of #4535
    Part of #4536
    
    @TarantoolBot document
    Title: User privileges update affects existing sessions and objects
    Previously if user privileges were updated (via
    `box.schema.user.grant/revoke`), it was not reflected in already
    existing sessions and objects like functions. Now it is.
    
    For example:
    ```
            box.cfg{listen = 3313}
            box.schema.user.create('test_user', {password = '1'})
            function test1() return 'success' end
    
            c = require('net.box').connect(box.cfg.listen, {
                    user = 'test_user', password = '1'
            })
            -- Error, no access for this connection.
            c:call('test1')
    
            box.schema.user.grant('test_user', 'execute', 'universe')
            -- Now works, even though access was granted after
            -- connection.
            c:call('test1')
    ```
    
    A similar thing happens now with `box.session.su` and functions
    created via `box.schema.func.create` with `setuid` flag.
    
    In other words, now user privileges update is reflected
    everywhere immediately.
    
    (cherry picked from commit 06dbcec597f14fae6b3a7fa2361f2ac513099662)
    (cherry picked from commit 2b599c0efa9ae265fb7464af6abae3f6a192e30e)
    b53bd593
    History
    access: update credentials without reconnect
    Vladislav Shpilevoy authored
    Credentials is a cache of user universal privileges. And that
    cache can become outdated in case user privs were changed after
    creation of the cache.
    
    The patch makes user update all its credentials caches with new
    privileges, via a list of all creds.
    
    That solves a couple of real life problems:
    
    - If a user managed to connect after box.cfg started listening
    port, but before access was granted, then he needed a reconnect;
    
    - Even if access was granted, a user may connect after box.cfg
    listen, but before access *is recovered* from _priv space. It
    was not possible to fix without a reconnect. And this problem
    affected replication.
    
    Closes #2763
    Part of #4535
    Part of #4536
    
    @TarantoolBot document
    Title: User privileges update affects existing sessions and objects
    Previously if user privileges were updated (via
    `box.schema.user.grant/revoke`), it was not reflected in already
    existing sessions and objects like functions. Now it is.
    
    For example:
    ```
            box.cfg{listen = 3313}
            box.schema.user.create('test_user', {password = '1'})
            function test1() return 'success' end
    
            c = require('net.box').connect(box.cfg.listen, {
                    user = 'test_user', password = '1'
            })
            -- Error, no access for this connection.
            c:call('test1')
    
            box.schema.user.grant('test_user', 'execute', 'universe')
            -- Now works, even though access was granted after
            -- connection.
            c:call('test1')
    ```
    
    A similar thing happens now with `box.session.su` and functions
    created via `box.schema.func.create` with `setuid` flag.
    
    In other words, now user privileges update is reflected
    everywhere immediately.
    
    (cherry picked from commit 06dbcec597f14fae6b3a7fa2361f2ac513099662)
    (cherry picked from commit 2b599c0efa9ae265fb7464af6abae3f6a192e30e)