You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
cockroachdb/cockroach#71134 --- Release note (security update): It is not possible any more to use a node TLS certificate to establish a SQL connection with another username than node. This facility had existed as an "escape hatch" so that an operator could use the node cert to perform operations on behalf of another SQL user. However, this facility is not necessary: an operator with access to a node cert can log in as node directly and create new credentials for another user anyway. By removing this facility, we tighten the guarantee that the principal in the TLS client cert always matches the SQL identity.
Exalate commented:
cockroachdb/cockroach#71134 --- Release note (security update): It is not possible any more to use a node TLS certificate to establish a SQL connection with another username than
node
. This facility had existed as an "escape hatch" so that an operator could use the node cert to perform operations on behalf of another SQL user. However, this facility is not necessary: an operator with access to a node cert can log in asnode
directly and create new credentials for another user anyway. By removing this facility, we tighten the guarantee that the principal in the TLS client cert always matches the SQL identity.Jira Issue: DOC-1222
The text was updated successfully, but these errors were encountered: