Support db_securityadmin #100

HarshLunagariya · 2024-10-20T19:35:37Z

Description

Extension PR : amazon-aurora/babelfish_extensions#70

Issues Resolved

BABEL-5135

Check List

Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is under the terms of the Apache 2.0 and PostgreSQL licenses, and grant any person obtaining a copy of the contribution permission to relicense all or a portion of my contribution to the PostgreSQL License solely to contribute all or a portion of my contribution to the PostgreSQL open source project.

For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Harsh Lunagariya <[email protected]>

src/backend/catalog/aclchk.c

Deepesh125 · 2024-10-22T13:39:24Z

src/bin/pg_dump/dump_babel_utils.c

 static char *default_bbf_db_principals =
-			"('master_dbo', 'master_db_owner', 'master_guest', 'master_db_accessadmin', "
-			"'msdb_dbo', 'msdb_db_owner', 'msdb_guest', 'msdb_db_accessadmin', "
-			"'tempdb_dbo', 'tempdb_db_owner', 'tempdb_guest', 'tempdb_db_accessadmin') ";
+			"('master_dbo', 'master_db_owner', 'master_guest', 'master_db_accessadmin', 'master_db_securityadmin', "
+			"'msdb_dbo', 'msdb_db_owner', 'msdb_guest', 'msdb_db_accessadmin', 'msdb_db_securityadmin', "
+			"'tempdb_dbo', 'tempdb_db_owner', 'tempdb_guest', 'tempdb_db_accessadmin', 'tempdb_db_securityadmin') ";


Instead of updating this static list everytime, is it possible to get this list dynamically using some query during dump? same is applicable for default_bbf_roles

It should be possible IMO, We can rely on the is_fixed_role metadata. Currently, we are not utilizing it and not even updating it for fixed roles.

Lets open internal jira to track this work.

Deepesh125 · 2024-10-22T13:40:11Z

src/bin/pg_dump/dump_babel_utils.c

@@ -1992,7 +1992,7 @@ dumpBabelPhysicalDatabaseACLs(Archive *fout)
 					"\n	SET LOCAL ROLE sysadmin;"
 					"\n	FOR rolname, original_name IN ("
 					"\n		SELECT a.rolname, a.orig_username FROM sys.babelfish_authid_user_ext a"
-					"\n			WHERE orig_username IN ('dbo','db_accessadmin') AND"
+					"\n			WHERE orig_username IN ('dbo','db_accessadmin','db_securityadmin') AND"


redeisgn/rethink this query so that we dont need to re-write this everytime

This needs to be backward compatible, so this will be an interesting challenge

Need @rishabhtanwar29 's opinion on this.

Support db_datareader/db_datawriter

Deepesh125 · 2024-10-25T08:57:17Z

src/bin/pg_dump/dump_babel_utils.c

@@ -53,9 +53,15 @@ typedef enum {
 static babelfish_status bbf_status = NONE;

 static char *default_bbf_db_principals =


isnt this list the same as default_bbf_roles defined in other file?

Description This commit adds support for db_securityadmin fixed database roles. Members of db_securityadmin can perform following operations within a particular database: create schema create database roles alter/drop user-defined database roles manage permissions via grant/revoke statements Engine Changes - amazon-aurora/postgresql_modified_for_babelfish#100 Issues Resolved BABEL-5135 Signed-off-by: Harsh Lunagariya <[email protected]>

This commit adds support for db_securityadmin fixed database roles. Members of db_securityadmin can perform following operations within a particular database: create schema create database roles alter/drop user-defined database roles manage permissions via grant/revoke statements Engine Changes - amazon-aurora/postgresql_modified_for_babelfish#100 Issues Resolved [BABEL-5135] Signed-off-by: Harsh Lunagariya <[email protected]>

Description Handle babelfish dump restore changes for fixed database role db_securityadmin Extension PR : amazon-aurora/babelfish_extensions#70 Signed-off-by: Harsh Lunagariya <[email protected]>

This commit adds support for db_securityadmin fixed database roles. Members of db_securityadmin can perform following operations within a particular database: create schema create database roles alter/drop user-defined database roles manage permissions via grant/revoke statements Engine Changes - amazon-aurora/postgresql_modified_for_babelfish#100 Issues Resolved [BABEL-5135] Signed-off-by: Harsh Lunagariya <[email protected]>

Description Handle babelfish dump restore changes for fixed database role db_securityadmin Extension PR : amazon-aurora/babelfish_extensions#70 Signed-off-by: Harsh Lunagariya <[email protected]>

This commit adds support for db_securityadmin fixed database roles. Members of db_securityadmin can perform following operations within a particular database: create schema create database roles alter/drop user-defined database roles manage permissions via grant/revoke statements Engine Changes - amazon-aurora/postgresql_modified_for_babelfish#100 Issues Resolved [BABEL-5135] Signed-off-by: Harsh Lunagariya <[email protected]>

Description Handle babelfish dump restore changes for fixed database role db_securityadmin Extension PR : amazon-aurora/babelfish_extensions#70 Signed-off-by: Harsh Lunagariya <[email protected]>

This commit adds support for db_securityadmin fixed database roles. Members of db_securityadmin can perform following operations within a particular database: create schema create database roles alter/drop user-defined database roles manage permissions via grant/revoke statements Engine Changes - amazon-aurora/postgresql_modified_for_babelfish#100 Issues Resolved [BABEL-5135] Signed-off-by: Harsh Lunagariya <[email protected]>

Description Handle babelfish dump restore changes for fixed database role db_securityadmin Extension PR : amazon-aurora/babelfish_extensions#70 Signed-off-by: Harsh Lunagariya <[email protected]>

HarshLunagariya added 3 commits October 20, 2024 19:34

engine changes

2af8275

Signed-off-by: Harsh Lunagariya <[email protected]>

dump/restore changes

85d6c5f

Signed-off-by: Harsh Lunagariya <[email protected]>

fix

8697a73

Signed-off-by: Harsh Lunagariya <[email protected]>

HarshLunagariya mentioned this pull request Oct 21, 2024

Support db_securityadmin amazon-aurora/babelfish_extensions#70

Merged

1 task

tanscorpio7 requested changes Oct 22, 2024

View reviewed changes

src/backend/catalog/aclchk.c Show resolved Hide resolved

Deepesh125 requested changes Oct 22, 2024

View reviewed changes

shalinilohia50 and others added 4 commits October 23, 2024 22:43

Merge pull request #98 from amazon-aurora/babel-3883

537c473

Support db_datareader/db_datawriter

Merge branch 'server-database-roles-4-x' into babel_dbsecadmin

6114c5f

Update dump_babel_utils.c

3f89485

Update dumpall_babel_utils.c

bdff47c

Deepesh125 reviewed Oct 25, 2024

View reviewed changes

Deepesh125 approved these changes Oct 25, 2024

View reviewed changes

tanscorpio7 force-pushed the server-database-roles-4-x branch from f5618f3 to 46ac851 Compare October 25, 2024 11:58

Merge branch 'server-database-roles-4-x' into babel_dbsecadmin

d5b2779

tanscorpio7 merged commit 16084d5 into server-database-roles-4-x Oct 31, 2024
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support db_securityadmin #100

Support db_securityadmin #100

HarshLunagariya commented Oct 20, 2024 •

edited by tanscorpio7

Loading

Deepesh125 Oct 22, 2024

HarshLunagariya Oct 24, 2024

Deepesh125 Oct 25, 2024

Deepesh125 Oct 22, 2024

tanscorpio7 Oct 23, 2024

HarshLunagariya Oct 24, 2024

Deepesh125 Oct 25, 2024

		@@ -53,9 +53,15 @@ typedef enum {
		static babelfish_status bbf_status = NONE;

		static char *default_bbf_db_principals =

Support db_securityadmin #100

Support db_securityadmin #100

Conversation

HarshLunagariya commented Oct 20, 2024 • edited by tanscorpio7 Loading

Description

Issues Resolved

Check List

Deepesh125 Oct 22, 2024

Choose a reason for hiding this comment

HarshLunagariya Oct 24, 2024

Choose a reason for hiding this comment

Deepesh125 Oct 25, 2024

Choose a reason for hiding this comment

Deepesh125 Oct 22, 2024

Choose a reason for hiding this comment

tanscorpio7 Oct 23, 2024

Choose a reason for hiding this comment

HarshLunagariya Oct 24, 2024

Choose a reason for hiding this comment

Deepesh125 Oct 25, 2024

Choose a reason for hiding this comment

HarshLunagariya commented Oct 20, 2024 •

edited by tanscorpio7

Loading