influxdata / influxdata/influxdb
'CreateDatabase' permission won't let user view retention policies
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
Chronograf using bunch of cluster permissions. One of the permissions is 'CreateDatabase'
User with only 'CreateDatabase' permission is not allowed to create a database. The documentation for chronograf mentions that user with this permission should be able to create databases, retention policies, alter and view retention policies.
The actual error message
```received status code 403 from server: err: error authorizing query: not authorized to execute statement 'SHOW RETENTION POLICIES ON _internal1```
What was found out is that user is able to create databases using db 'influx' command:
root@ip-10-0-105-191:/home/ubuntu# influx -username user_CreateDatabase -password user_CreateDatabase
Connected to http://localhost:8086 version 1.5.2-c1.5.2
InfluxDB shell version: 1.5.2-c1.5.2
`create database WOW with duration 3d replication 1 shard duration 1h name "works"`
User also can create and alter a retention policy
`create retention policy "HELLO" on "WOW" DURATION 1d REPLICATION 2 SHARD DURATION 1h DEFAULT`
`alter retention policy "HELLO" ON "WOW" DURATION 5d`
**BUT** User was not able to view retention policies on the created database using 'SHOW RETENTION POLICIES' command, the error
`error authorizing query: user_CreateDatabase not authorized to execute statement 'SHOW RETENTION POLICIES'`
Contributor guide
Assessment
This issue has not been assessed yet.