|
MySQLAuth was fixed to check role permissions in MXS-872. It looks like PAMAuth needs a similar fix. See here:
https://github.com/mariadb-corporation/MaxScale/blob/maxscale-2.3.7/server/modules/authenticator/PAM/PAMAuth/pam_instance.cc#L205
Let's say that you define a PAM user like this:
CREATE ROLE 'admin_role';
|
GRANT ALL PRIVILEGES ON *.* TO 'admin_role';
|
CREATE USER 'pamuser'@'%' IDENTIFIED VIA pam USING 'mariadb';
|
GRANT 'admin_role' TO 'pamuser'@'%';
|
SET DEFAULT ROLE 'admin_role' FOR 'pamuser'@'%';
|
Currently, MaxScale will not recognize the PAM user, because it assumes that it has no privileges. The MaxScale log will contain entries like this:
2019-06-04 10:07:03 notice : Service 'db-service-pam' started (3/12)
|
2019-06-04 10:11:02 notice : Loaded 0 users for service db-service-pam
|
|