Add proper Postgres roles/rights parsing during validation checks [DBZ-2894]
- Dominant language
- HTML
- Stars
- 6
- Forks
- 8
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 1
Description
Migrated from [DBZ-2894](https://issues.redhat.com/browse/DBZ-2894)
The current implementation relies on role names, which might be problematic. We only validate the current user rights or an assignment to special roles/groups that are specific to cloud providers, like AWS (see DBZ-2800 / [https://github.com/debezium/debezium/pull/2037]).
I suggest we properly traverse user and group/role permission tree and parse the specific rights if they match the requirements for the Debezium user: a user can be assigned to a group which is assigned to a group which is again assigned to a group ... which has the sufficient PG rights like rolreplication, rolcanlogin.
Contributor guide
Research direction
Start by locating the current validation implementation that relies on role names, then review DBZ-2800 and pull request 2037 for related cloud-provider role handling. Done means traversing nested user and group/role assignments and validating the required PostgreSQL rights, including rolreplication and rolcanlogin.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- postgresql
- Domain
- databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100