Details
-
New Feature
-
Status: In Progress (View Workflow)
-
Major
-
Resolution: Unresolved
-
25.10.3
-
None
-
MXS-SPRINT-275, MXS-SPRINT-276
Description
Today, cdc does not create users in exasol.
This is a security issue as all queries funnel through the same service user.
This will require mapping user grants from mariadb to exasol
Phase 1 seeks basic global level, database & table level grants and permissions to be sync'd
https://mariadbcorp.atlassian.net/browse/MSQA-61
MariaDB: https://mariadb.com/docs/server/reference/sql-statements/account-management-sql-statements/grant
Exasol: https://docs.exasol.com/db/latest/database_concepts/privileges/details_rights_management.htm
Exasol's privilege model splits privileges into two scopes:
- System privileges — granted like GRANT CREATE TABLE TO user;. No object named in the grant. Once a user has it, the privilege applies everywhere they have schema access — there's no ON schema_name clause possible.
- Object privileges — granted like GRANT SELECT ON schema.table TO user;. These do name a specific object, and only apply to that object.
Example:
MariaDB:
GRANT CREATE TABLE TO user;
|
Get converted to Exasol:
GRANT CREATE TABLE ANY SCHEMA TO user;
|
| MariaDB Privilege | Exasol Equivalent | Category | Notes |
|---|---|---|---|
| SELECT | SELECT (object) / SELECT ANY TABLE (system) | DML | Object-level is per-table/view; system-level is global |
| INSERT | INSERT (object) | DML | Same concept |
| UPDATE | UPDATE (object) | DML | Same concept |
| DELETE | DELETE (object) | DML | Same concept |
| REFERENCES | REFERENCES (object) | DML | Both gate FK creation against referenced table |
| CREATE (table) | CREATE TABLE (system) | DDL | Exasol grants at system level, not per-schema |
| CREATE ON . (database) | CREATE SCHEMA (system) | DDL | |
| DROP | Object owner right, or DROP ANY TABLE / DROP ANY SCHEMA (system) | DDL | Exasol leans on ownership by default |
| ALTER | ALTER (object) / ALTER ANY TABLE (system) | DDL | |
| CREATE VIEW | CREATE VIEW (system) | DDL | |
| CREATE ROUTINE / ALTER ROUTINE | CREATE SCRIPT (system) | DDL | Exasol calls UDFs/procs "scripts" |
| EXECUTE | EXECUTE (object) | DDL | Applies to scripts/functions in Exasol |
| INDEX | No equivalent | DDL | Exasol manages indexing automatically |
| TRIGGER | No equivalent | DDL | Exasol has no triggers |
| EVENT | No equivalent | DDL | No SQL-level scheduled events in Exasol |
| CREATE USER | CREATE USER (system) | Users/Roles | |
| (implicit in CREATE USER) | DROP USER (system) | Users/Roles | Exasol splits this out separately |
| (roles via CREATE USER priv) | CREATE ROLE (system) | Users/Roles | Exasol splits this out separately |
| GRANT OPTION (per-privilege) | GRANT ANY OBJECT PRIVILEGE (system) | Users/Roles | Exasol's version is all-or-nothing, not scoped per grant |
| SUPER | DBA role (built-in) | Users/Roles | Exasol bundles admin rights into a built-in role |
| FILE | CREATE CONNECTION + ACCESS ON CONNECTION | Architecture gap | Exasol gates external access via named CONNECTION objects |
| REPLICATION SLAVE / REPLICATION CLIENT | No equivalent | Architecture gap | Exasol has no binlog-based replication model |
| RELOAD / PROCESS / LOCK TABLES / CREATE TEMPORARY TABLES | No direct equivalent | Architecture gap | Folded into DBA/ownership rather than discrete privileges |
| USAGE (false friend) | USAGE (different meaning) | Naming collision | MariaDB: placeholder for "no privileges." Exasol: required object privilege to access anything in a schema at all |
Attachments
Issue Links
- relates to
-
MXS-6623 Exasol router refactor to session user
-
- In Review
-
- blocks
-
MCDEV-3054 Loading...