Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-4397

Roles

Details

    • Task
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • 10.0.5
    • None

    Description

      Roles

      As (or close to) defined in the SQL:2003 standard.

      New statements

      CREATE ROLE role
      		 
      DROP ROLE role
      		 
      GRANT role TO { user | user }
      		 
      REVOKE role FROM {user | role }
      		 
      SET ROLE { role_name | NONE }

      According to the standard, role and user names live in the same namespace. But in MariaDB a user name has a mandatory @host part (even if it's @%). And we probably wouldn't want it for roles. So, practically, we will have users and roles in different name spaces, with a little ambiguity, when a user name is specified without a @host part, where allowed. Alternatively, we can specify that a role name cannot match the first part of any user name. May be it'll be less confusing this way.

      Only one role can be set to a user at any specific point in any given session. In other words, CURRENT_ROLE (see below) can never return a list.

      Privileges

      One needs CREATE USER privilege to create or drop a role. Or an appropriate (insert or delete) privilege on the mysql database.

      One needs a role to be granted to himself WITH ADMIN OPTION to be able to grant or revoke it further. A creator of a role gets it automatically granted to himself WITH ADMIN CURRENT_USER. Alternatively, one can use WITH ADMIN CURRENT_ROLE or (with SUPER privilege) WITH ADMIN arbitrary_definer.

      Existing statements need to work with roles

      REVOKE privilege FROM { user | role }
      		 
      GRANT privilege TO { user | role }
      		 
      SHOW GRANTS FOR { user | role }

      New functions

      CURRENT_ROLE
      		 
      CURRENT_ROLE()

      If there is no current role, the function returns NULL, not "NONE".

      Informational tables

      INFORMATION_SCHEMA.APPLICABLE_ROLES
      		 
      INFORMATION_SCHEMA.ENABLED_ROLES

      there are more tables in the INFORMATION_SCHEMA that are relevant for roles. They are not part of this task.

      DEFINER=CURRENT_ROLE

      Everywhere where one can write DEFINER=xxx, we should allow xxx to be a role name. And additionally we'll support DEFINER=CURRENT_ROLE.

      Reserved role names

      The role name of PUBLIC is reserved. There can be no role with this name. But this name can be used in GRANT and REVOKE statements as a grantee.Privileges granted to PUBLIC are always available to everyone. Implementing it is not part of this task.

      The role name of NONE is reserved too.

      Default role (not part of this task)

      Syntax variants (which ones we'll do?):

      CREATE USER xxx DEFAULT ROLE yyy;
      		 
      ALTER USER xxx DEFAULT ROLE yyy;
      		 
      SET DEFAULT ROLE yyy;
      		 
      SET DEFAULT ROLE yyy [ FOR xxx ];

      When a default role is set, the server implicitly runs SET ROLE yyy for every new connection (or after a COM_CHANGE_USER for a user xxx.

      Attachments

        Issue Links

          blocks

          Task - A task that needs to be done. MDEV-5164 Testing Roles

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          causes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-24345 WITH ADMIN OPTION privilege is missing from SHOW PRIVILEGES

          • Major - Major loss of function.
          • Closed
          duplicates

          Task - A task that needs to be done. MDEV-14444 Support Role based access control for MariaDB privilege system

          • Major - Major loss of function.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5166 10.0-roles does not build with BUILD/compile-pentium-debug-max-no-ndb

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5170 Assertion `(&(&acl_cache->lock)->m_mutex)->count > 0 && pthread_equal(pthread_self(), (&(&acl_cache->lock)->m_mutex)->thread)' fails after restarting server with a pre-created role grants

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5172 safe_mutex: Trying to lock mutex when the mutex was already locked on using a role and I_S role tables

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5175 Revoking a role does not revoke corresponding grants from open sessions

          • Major - Major loss of function.
          • Closed

          Task - A task that needs to be done. MDEV-5211 Rename role

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

          Task - A task that needs to be done. MDEV-5212 Role support for Audit Plugin API

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

          Task - A task that needs to be done. MDEV-5215 Granted to PUBLIC

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5221 User auto-creation does not work upon GRANT <role>

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5223 Server crashes on REVOKE ... from CURRENT_ROLE

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5225 Server crashes on CREATE USER|ROLE CURRENT_ROLE or DROP ROLE CURRENT_ROLE

          • Major - Major loss of function.
          • Closed

          Task - A task that needs to be done. MDEV-5227 Resolve the ambiguity between user and role names as mentioned in MDEV-4397

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5228 Incorrect message test on a failed attempt to revoke grants from a role

          • Trivial - Cosmetic problem like misspelt words or misaligned text.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5232 SET ROLE checks privileges differently from check_access()

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5237 Minor inconsistency between current_role and I_S.enabled_roles

          • Trivial - Cosmetic problem like misspelt words or misaligned text.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5238 Server crashes in find_role_grant_pair on SHOW GRANTS for an anonymous user

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5668 Assertion `granted_role->is_role()' fails on granting role with empty name

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5669 Possible inconsistencies or lack of documentation in role privilege grants and propogation

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5771 Privileges acquired via roles depend on the order of granting

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-5772 Granting multiple roles in single statement does not work

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

          Task - A task that needs to be done. MDEV-5210 Default role

          • Major - Major loss of function.
          • Closed

          Task - A task that needs to be done. MDEV-5213 Roles: OOM checks

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

          Activity

            People

              serg Sergei Golubchik
              serg Sergei Golubchik
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.