debezium / debezium/dbz

Add proper Postgres roles/rights parsing during validation checks [DBZ-2894]

Open
#404 0 comments 0 reactions 0 assignees View on GitHub
component/postgresql-connector migrated-from-jira type/enhancement
Dominant language
HTML
Stars
6
Forks
8
Avg merge
2d 19h
Merged PRs (30d)
1

Description

Migrated from [DBZ-2894](https://issues.redhat.com/browse/DBZ-2894)

The current implementation relies on role names, which might be problematic. We only validate the current user rights or an assignment to special roles/groups that are specific to cloud providers, like AWS (see DBZ-2800 / [https://github.com/debezium/debezium/pull/2037]).

I suggest we properly traverse user and group/role permission tree and parse the specific rights if they match the requirements for the Debezium user: a user can be assigned to a group which is assigned to a group which is again assigned to a group ... which has the sufficient PG rights like rolreplication, rolcanlogin. 

Contributor guide

Open the contributing guide

Research direction

Start by locating the current validation implementation that relies on role names, then review DBZ-2800 and pull request 2037 for related cloud-provider role handling. Done means traversing nested user and group/role assignments and validating the required PostgreSQL rights, including rolreplication and rolcanlogin.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql
Domain
databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.