Skip to content
Snippets Groups Projects
  1. Oct 30, 2019
    • Vladislav Shpilevoy's avatar
      access: update credentials without reconnect · b53bd593
      Vladislav Shpilevoy authored
      Credentials is a cache of user universal privileges. And that
      cache can become outdated in case user privs were changed after
      creation of the cache.
      
      The patch makes user update all its credentials caches with new
      privileges, via a list of all creds.
      
      That solves a couple of real life problems:
      
      - If a user managed to connect after box.cfg started listening
      port, but before access was granted, then he needed a reconnect;
      
      - Even if access was granted, a user may connect after box.cfg
      listen, but before access *is recovered* from _priv space. It
      was not possible to fix without a reconnect. And this problem
      affected replication.
      
      Closes #2763
      Part of #4535
      Part of #4536
      
      @TarantoolBot document
      Title: User privileges update affects existing sessions and objects
      Previously if user privileges were updated (via
      `box.schema.user.grant/revoke`), it was not reflected in already
      existing sessions and objects like functions. Now it is.
      
      For example:
      ```
              box.cfg{listen = 3313}
              box.schema.user.create('test_user', {password = '1'})
              function test1() return 'success' end
      
              c = require('net.box').connect(box.cfg.listen, {
                      user = 'test_user', password = '1'
              })
              -- Error, no access for this connection.
              c:call('test1')
      
              box.schema.user.grant('test_user', 'execute', 'universe')
              -- Now works, even though access was granted after
              -- connection.
              c:call('test1')
      ```
      
      A similar thing happens now with `box.session.su` and functions
      created via `box.schema.func.create` with `setuid` flag.
      
      In other words, now user privileges update is reflected
      everywhere immediately.
      
      (cherry picked from commit 06dbcec597f14fae6b3a7fa2361f2ac513099662)
      (cherry picked from commit 2b599c0efa9ae265fb7464af6abae3f6a192e30e)
      b53bd593
Loading