Uploaded image for project: 'Cassandra'
  1. Cassandra
  2. CASSANDRA-18018

List command output not correct for super user, after grant command

    XMLWordPrintableJSON

Details

    • Correctness - API / Semantic Definition
    • Low
    • Normal
    • User Report
    • All
    • None

    Description

      Running local Cassandra with below config:

      authenticator: PasswordAuthenticator
      authorizer: CassandraAuthorizer
      role_manager: CassandraRoleManager
      network_authorizer: CassandraNetworkAuthorizer

      Created a super user and then ran Grant select command on a keyspace. 

      shaadmin1@cqlsh> CREATE USER 'shaadmin1c1' WITH PASSWORD 'shaadmin1c1' SUPERUSER;
      shaadmin1@cqlsh:system_auth> grant select on testk1.t1 to shaadmin1c1;
      shaadmin1@cqlsh:system_auth> alter role shaadmin1c1 with access to all datacenters;
      

       

      After this, list permissions command showing only select permission for that role on the resource.

      shaadmin1c1@cqlsh> list all permissions of shaadmin1c1;
      role | username | resource | permission
      ----------------------------------------+-----------
      shaadmin1c1 | shaadmin1c1 | <table testk1.t1> | SELECT
      

       

      Row in role_permissions table:

      role | resource | permissions
      ------------------------------------------------------------------------------------------
      shaadmin1c1 | data/testk1/t1 | {'SELECT'}

      But insert command by that role on the resource is successful because role is a super user

      shaadmin1c1@cqlsh> insert into testk1.t1 (c1, c2) values ('a', 1);
      shaadmin1c1@cqlsh> select * from testk1.t1 ;
      c1 | c2
      ---+---
      a | 1
      (1 rows)
      

       

      The problem is, output of list permissions command, which indicates only select permission on the resource, is misleading. I think list command need to be fixed to show all permissions super user has on the resource. Also grant command for a super user can be either a no-op or throw error, because the role already have requested permissions.

       

      Documentation also misleading:

      True automatically grants AUTHORIZE, CREATE and DROP permission on ALL ROLES.
      Superusers can only manage roles by default. To manage other resources, you must grant the permission set to that resource. ** For example, to allow access management for all keyspaces: GRANT ALL PERMISSIONS ON ALL KEYSPACES TO }}{{{}role_name.

       

       

       

      Attachments

        Activity

          People

            maximc Maxim Chanturiay
            skoppu Shailaja Koppu
            Maxim Chanturiay
            Sam Tunnicliffe, Shailaja Koppu
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 1h
                1h