influxdata / influxdata/influxdb

'CreateDatabase' permission won't let user view retention policies

Open
#9,727 1 comment 0 reactions 1 assignee Claimed by @rbetts View on GitHub
1.x area/auth pm/review
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

Chronograf using bunch of cluster permissions. One of the permissions is 'CreateDatabase'
User with only 'CreateDatabase' permission is not allowed to create a database. The documentation for chronograf mentions that user with this permission should be able to create databases, retention policies, alter and view retention policies.
The actual error message
```received status code 403 from server: err: error authorizing query: not authorized to execute statement 'SHOW RETENTION POLICIES ON _internal1```

What was found out is that user is able to create databases using db 'influx' command:
root@ip-10-0-105-191:/home/ubuntu# influx -username user_CreateDatabase -password user_CreateDatabase
Connected to http://localhost:8086 version 1.5.2-c1.5.2
InfluxDB shell version: 1.5.2-c1.5.2
`create database WOW with duration 3d replication 1 shard duration 1h name "works"`

User also can create and alter a retention policy

`create retention policy "HELLO" on "WOW" DURATION 1d REPLICATION 2 SHARD DURATION 1h DEFAULT`
`alter retention policy "HELLO" ON "WOW" DURATION 5d`

**BUT** User was not able to view retention policies on the created database using 'SHOW RETENTION POLICIES' command, the error
`error authorizing query: user_CreateDatabase not authorized to execute statement 'SHOW RETENTION POLICIES'`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.