Uploaded image for project: 'MariaDB MaxScale'
  1. MariaDB MaxScale
  2. MXS-6612

exasol cdc sync users

    XMLWordPrintable

Details

    • New Feature
    • Status: In Progress (View Workflow)
    • Major
    • Resolution: Unresolved
    • 25.10.3
    • 26.10.0
    • exasol-cdc
    • None

    Description

      Today, cdc does not create users in exasol.

      This is a security issue as all queries funnel through the same service user.
      This will require mapping user grants from mariadb to exasol

      Phase 1 seeks basic global level, database & table level grants and permissions to be sync'd
      https://mariadbcorp.atlassian.net/browse/MSQA-61

      MariaDB: https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant
      Exasol: https://docs.exasol.com/db/latest/database_concepts/privileges/details_rights_management.htm

      Exasol's privilege model splits privileges into two scopes:

      • System privileges — granted like GRANT CREATE TABLE TO user;. No object named in the grant. Once a user has it, the privilege applies everywhere they have schema access — there's no ON schema_name clause possible.
      • Object privileges — granted like GRANT SELECT ON schema.table TO user;. These do name a specific object, and only apply to that object.

      Example:
      MariaDB:

      GRANT CREATE TABLE TO user;
      

      Get converted to Exasol:

      GRANT CREATE TABLE ANY SCHEMA TO user;
      

      MariaDB Privilege Exasol Equivalent Category Notes
      SELECT SELECT (object) / SELECT ANY TABLE (system) DML Object-level is per-table/view; system-level is global
      INSERT INSERT (object) DML Same concept
      UPDATE UPDATE (object) DML Same concept
      DELETE DELETE (object) DML Same concept
      REFERENCES REFERENCES (object) DML Both gate FK creation against referenced table
      CREATE (table) CREATE TABLE (system) DDL Exasol grants at system level, not per-schema
      CREATE ON . (database) CREATE SCHEMA (system) DDL  
      DROP Object owner right, or DROP ANY TABLE / DROP ANY SCHEMA (system) DDL Exasol leans on ownership by default
      ALTER ALTER (object) / ALTER ANY TABLE (system) DDL  
      CREATE VIEW CREATE VIEW (system) DDL  
      CREATE ROUTINE / ALTER ROUTINE CREATE SCRIPT (system) DDL Exasol calls UDFs/procs "scripts"
      EXECUTE EXECUTE (object) DDL Applies to scripts/functions in Exasol
      INDEX No equivalent DDL Exasol manages indexing automatically
      TRIGGER No equivalent DDL Exasol has no triggers
      EVENT No equivalent DDL No SQL-level scheduled events in Exasol
      CREATE USER CREATE USER (system) Users/Roles  
      (implicit in CREATE USER) DROP USER (system) Users/Roles Exasol splits this out separately
      (roles via CREATE USER priv) CREATE ROLE (system) Users/Roles Exasol splits this out separately
      GRANT OPTION (per-privilege) GRANT ANY OBJECT PRIVILEGE (system) Users/Roles Exasol's version is all-or-nothing, not scoped per grant
      SUPER DBA role (built-in) Users/Roles Exasol bundles admin rights into a built-in role
      FILE CREATE CONNECTION + ACCESS ON CONNECTION Architecture gap Exasol gates external access via named CONNECTION objects
      REPLICATION SLAVE / REPLICATION CLIENT No equivalent Architecture gap Exasol has no binlog-based replication model
      RELOAD / PROCESS / LOCK TABLES / CREATE TEMPORARY TABLES No direct equivalent Architecture gap Folded into DBA/ownership rather than discrete privileges
      USAGE (false friend) USAGE (different meaning) Naming collision MariaDB: placeholder for "no privileges." Exasol: required object privilege to access anything in a schema at all

      Attachments

        Issue Links

          Activity

            People

              nantti Niclas Antti
              allen.herrera Allen Herrera
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 8d
                  8d
                  Remaining:
                  Time Spent - 3h Remaining Estimate - 7d 5h
                  7d 5h
                  Logged:
                  Time Spent - 3h Remaining Estimate - 7d 5h
                  3h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.