ldap2pg tries to grant privilege on FUNCTION/ROUTINE even if it is already granted
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 236
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
Hi!
Ive encountered an issue after updating ldap2pg from ver. 6.4 to 6.5.1 where EXECUTE privileges on functions (and routines as well) are re-applied on every run, even though they are already granted.
CHANGE Grant privileges. grant="GLOBAL DEFAULT FOR user EXECUTE ON FUNCTIONS TO ldap_group_1" database=test
As it seems in DEBUG it detects that the privilege is granted:
DEBUG Found grant in Postgres instance. grant="GLOBAL DEFAULT FOR user EXECUTE ON FUNCTIONS TO ldap_group_1" database=test
But anyway it tries to grant it:
DEBUG Wants grant. grant="GLOBAL DEFAULT FOR user EXECUTE ON FUNCTIONS TO ldap_group_1" database=test
I noticed a possible inconsistency in how function/routine default privileges are represented:
internal/privileges/sql/global-default.sql
...
CASE defaclobjtype
WHEN 'f' THEN 'FUNCTIONS'
...
internal/privileges/sql/schema-default.sql
...
CASE defaclobjtype
WHEN 'f' THEN 'ROUTINES'
...
(As its mentioned in https://www.postgresql.org/docs/16/catalog-pg-default-acl.htm defaclobjtype char "f" states for function)
At first I thought this could be caused by FUNCTIONS vs ROUTINES, but changing functions to routines in the config does not change the behavior.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing internal/privileges/sql/global-default.sql with internal/privileges/sql/schema-default.sql, focusing on how PostgreSQL function default privileges are represented. Reproduce the repeated EXECUTE grant using the shown GLOBAL DEFAULT configuration, then trace why the detected grant does not match the desired grant; done means subsequent runs no longer re-apply an existing privilege.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, postgresql
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100