access: update credentials without reconnect
Credentials is a cache of user universal privileges. And that cache can become outdated in case user privs were changed after creation of the cache. The patch makes user update all its credentials caches with new privileges, via a list of all creds. That solves a couple of real life problems: - If a user managed to connect after box.cfg started listening port, but before access was granted, then he needed a reconnect; - Even if access was granted, a user may connect after box.cfg listen, but before access *is recovered* from _priv space. It was not possible to fix without a reconnect. And this problem affected replication. Closes #2763 Part of #4535 Part of #4536 @TarantoolBot document Title: User privileges update affects existing sessions and objects Previously if user privileges were updated (via `box.schema.user.grant/revoke`), it was not reflected in already existing sessions and objects like functions. Now it is. For example: ``` box.cfg{listen = 3313} box.schema.user.create('test_user', {password = '1'}) function test1() return 'success' end c = require('net.box').connect(box.cfg.listen, { user = 'test_user', password = '1' }) -- Error, no access for this connection. c:call('test1') box.schema.user.grant('test_user', 'execute', 'universe') -- Now works, even though access was granted after -- connection. c:call('test1') ``` A similar thing happens now with `box.session.su` and functions created via `box.schema.func.create` with `setuid` flag. In other words, now user privileges update is reflected everywhere immediately. (cherry picked from commit 06dbcec597f14fae6b3a7fa2361f2ac513099662)
Showing
- src/box/user.cc 11 additions, 8 deletionssrc/box/user.cc
- src/box/user.h 6 additions, 0 deletionssrc/box/user.h
- src/box/user_def.h 7 additions, 0 deletionssrc/box/user_def.h
- test/box/access_bin.result 4 additions, 5 deletionstest/box/access_bin.result
- test/box/access_bin.test.lua 2 additions, 3 deletionstest/box/access_bin.test.lua
- test/box/access_misc.result 1 addition, 1 deletiontest/box/access_misc.result
- test/box/gh-2763-session-credentials-update.result 173 additions, 0 deletionstest/box/gh-2763-session-credentials-update.result
- test/box/gh-2763-session-credentials-update.test.lua 94 additions, 0 deletionstest/box/gh-2763-session-credentials-update.test.lua
Loading
Please register or sign in to comment