dalibo / dalibo/ldap2pg

ldap2pg tries to grant privilege on FUNCTION/ROUTINE even if it is already granted

Open
#768 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
236
Forks
34
PR merge metrics
No merged PRs in 30d

Description

Hi!
Ive encountered an issue after updating ldap2pg from ver. 6.4 to 6.5.1 where EXECUTE privileges on functions (and routines as well) are re-applied on every run, even though they are already granted.

 CHANGE Grant privileges.                                grant="GLOBAL DEFAULT FOR user EXECUTE ON FUNCTIONS TO ldap_group_1" database=test

As it seems in DEBUG it detects that the privilege is granted:

DEBUG  Found grant in Postgres instance.                grant="GLOBAL DEFAULT FOR user EXECUTE ON FUNCTIONS TO ldap_group_1" database=test

But anyway it tries to grant it:

 DEBUG  Wants grant.                                     grant="GLOBAL DEFAULT FOR user EXECUTE ON FUNCTIONS TO ldap_group_1" database=test

I noticed a possible inconsistency in how function/routine default privileges are represented:

internal/privileges/sql/global-default.sql

...
CASE defaclobjtype
WHEN 'f' THEN 'FUNCTIONS'
...

internal/privileges/sql/schema-default.sql

...
CASE defaclobjtype
WHEN 'f' THEN 'ROUTINES'
...

(As its mentioned in https://www.postgresql.org/docs/16/catalog-pg-default-acl.htm defaclobjtype char "f" states for function)
At first I thought this could be caused by FUNCTIONS vs ROUTINES, but changing functions to routines in the config does not change the behavior.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing internal/privileges/sql/global-default.sql with internal/privileges/sql/schema-default.sql, focusing on how PostgreSQL function default privileges are represented. Reproduce the repeated EXECUTE grant using the shown GLOBAL DEFAULT configuration, then trace why the detected grant does not match the desired grant; done means subsequent runs no longer re-apply an existing privilege.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, postgresql
Domain
databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.