influxdata / influxdata/influxdb

`influx auth create` does not work as expected for system buckets

Open
#21,607 0 comments 0 reactions 0 assignees View on GitHub
area/2.x area/cli
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

The issue here is that if you use `influx auth create` with read/write access to a system bucket like `_monitoring`, the token appears to be created successfully, however these system buckets are not actually accessible to anything other than an all-access token (apparently).

For example:

```
./influx bucket list
ID Name Retention Shard group duration Organization ID
1c9450961b31a442 _monitoring 168h0m0s 24h0m0s f50eed62e5df577e
3d216bc6005d3847 _tasks 72h0m0s 24h0m0s f50eed62e5df577e
6e480b4d6faf6d3b bucket infinite 168h0m0s f50eed62e5df577e
```

```
./influx auth create --read-bucket 1c9450961b31a442 --write-bucket 1c9450961b31a442
```

Then if you make a config using that token and set it to active...

```
./influx bucket list
ID Name Retention Shard group duration Organization ID
```

Ideally, the created token would either have access to the bucket, or an error would be returned to indicate that such a token is not possible.

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with `influx auth create` and `influx bucket list` using `_monitoring` or `_tasks`. Trace the auth-create entry point and the authorization path for system buckets; done means the token can access the bucket or creation returns a clear error explaining that it cannot.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authorization, cli, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.