You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Tiago R. Espinha (JIRA)" <ji...@apache.org> on 2009/04/09 23:59:12 UTC
[jira] Created: (DERBY-4156) SQL Roles - Granting privileges to a
role before creating it generates weird behavior
SQL Roles - Granting privileges to a role before creating it generates weird behavior
-------------------------------------------------------------------------------------
Key: DERBY-4156
URL: https://issues.apache.org/jira/browse/DERBY-4156
Project: Derby
Issue Type: Bug
Components: SQL
Affects Versions: 10.5.1.0
Environment: - Windows Vista x64
- Sun Java 6
Reporter: Tiago R. Espinha
While doing the buddy testing for the SQL roles, I believe I have found a bug.
Reproduction:
ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;cr
eate=true';
ij> create table t1 (f1 int, f2 varchar(200));
0 rows inserted/updated/deleted
ij> create role testCreateFirst;
0 rows inserted/updated/deleted
ij> grant select on t1 to testCreateFirst;
0 rows inserted/updated/deleted
ij> grant testCreateFirst to tiago;
0 rows inserted/updated/deleted
ij> grant update on t1 to testWithoutCreate;
0 rows inserted/updated/deleted
ij> grant testWithoutCreate to adm;
ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
ij> create role testWithoutCreate;
ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-4156) SQL Roles - Granting privileges to a
role before creating it generates weird behavior
Posted by "Tiago R. Espinha (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-4156?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12697975#action_12697975 ]
Tiago R. Espinha commented on DERBY-4156:
-----------------------------------------
Hello Rick,
There is just one thing that I am not quite getting yet. If I'm using built-in authentication, why would Derby create a permission tuple for a user that does not exist? If I am not mistaken, on built-in authentication the only way to have users added to our system is by adding them to the derby.properties file; that is, you cannot have users added manually through DDL.
I just think that seeing that the standard stipulates the GRANT/REVOKE should work across both users and roles, then maybe we simply should not create that permission tuple to accommodate the GRANT.
If no role or user exists with the specified name, then in my opinion an error should be thrown... unless of course, the standard also mentions the behavior seen in Derby.
Tiago
> SQL Roles - Granting privileges to a role before creating it generates weird behavior
> -------------------------------------------------------------------------------------
>
> Key: DERBY-4156
> URL: https://issues.apache.org/jira/browse/DERBY-4156
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.5.1.0
> Environment: - Windows Vista x64
> - Sun Java 6
> Reporter: Tiago R. Espinha
> Attachments: derby.properties
>
>
> While doing the buddy testing for the SQL roles, I believe I have found a bug.
> Reproduction:
> ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
> ij> create table t1 (f1 int, f2 varchar(200));
> 0 rows inserted/updated/deleted
> ij> create role testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant select on t1 to testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant testCreateFirst to tiago;
> 0 rows inserted/updated/deleted
> ij> grant update on t1 to testWithoutCreate;
> 0 rows inserted/updated/deleted
> ij> grant testWithoutCreate to adm;
> ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
> ij> create role testWithoutCreate;
> ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
> ---------------------8<----------------------
> This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
> The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
> Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-4156) SQL Roles - Granting privileges to a
role before creating it generates weird behavior
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-4156?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12698387#action_12698387 ]
Rick Hillegas commented on DERBY-4156:
--------------------------------------
Hi Tiago,
I don't believe that there is any special logic which changes the behavior of GRANT/REVOKE based on the kind of authentication Derby is doing. That is, I don't think that there is a separate code path for GRANT/REVOKE if you are using BUILTIN vs. LDAP authentication. I believe we decided that it would be less confusing if GRANT/REVOKE behaved the same way regardless of whether authentication happened via BUILTIN, LDAP, or another user-coded scheme.
In the LDAP and user-coded cases, we don't know what the universe of user names is--the best we can do is calculate the universe of users who are currently logged in. Rather than forbid useful GRANTs to users who aren't logged in, we decided to allow GRANTs to invisible users.
I wouldn't recommend putting in a separate code path for BUILTIN authentication. I regard BUILTIN as a testing tool and not a production-ready scheme for managing passwords.
Cheers,
-Rick
> SQL Roles - Granting privileges to a role before creating it generates weird behavior
> -------------------------------------------------------------------------------------
>
> Key: DERBY-4156
> URL: https://issues.apache.org/jira/browse/DERBY-4156
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.5.1.0
> Environment: - Windows Vista x64
> - Sun Java 6
> Reporter: Tiago R. Espinha
> Attachments: derby.properties
>
>
> While doing the buddy testing for the SQL roles, I believe I have found a bug.
> Reproduction:
> ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
> ij> create table t1 (f1 int, f2 varchar(200));
> 0 rows inserted/updated/deleted
> ij> create role testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant select on t1 to testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant testCreateFirst to tiago;
> 0 rows inserted/updated/deleted
> ij> grant update on t1 to testWithoutCreate;
> 0 rows inserted/updated/deleted
> ij> grant testWithoutCreate to adm;
> ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
> ij> create role testWithoutCreate;
> ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
> ---------------------8<----------------------
> This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
> The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
> Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-4156) SQL Roles - Granting privileges to a
role before creating it generates weird behavior
Posted by "Tiago R. Espinha (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-4156?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tiago R. Espinha updated DERBY-4156:
------------------------------------
Description:
While doing the buddy testing for the SQL roles, I believe I have found a bug.
Reproduction:
ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
ij> create table t1 (f1 int, f2 varchar(200));
0 rows inserted/updated/deleted
ij> create role testCreateFirst;
0 rows inserted/updated/deleted
ij> grant select on t1 to testCreateFirst;
0 rows inserted/updated/deleted
ij> grant testCreateFirst to tiago;
0 rows inserted/updated/deleted
ij> grant update on t1 to testWithoutCreate;
0 rows inserted/updated/deleted
ij> grant testWithoutCreate to adm;
ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
ij> create role testWithoutCreate;
ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
---------------------8<----------------------
This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
was:
While doing the buddy testing for the SQL roles, I believe I have found a bug.
Reproduction:
ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
ij> create table t1 (f1 int, f2 varchar(200));
0 rows inserted/updated/deleted
ij> create role testCreateFirst;
0 rows inserted/updated/deleted
ij> grant select on t1 to testCreateFirst;
0 rows inserted/updated/deleted
ij> grant testCreateFirst to tiago;
0 rows inserted/updated/deleted
ij> grant update on t1 to testWithoutCreate;
0 rows inserted/updated/deleted
ij> grant testWithoutCreate to adm;
ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
ij> create role testWithoutCreate;
ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
> SQL Roles - Granting privileges to a role before creating it generates weird behavior
> -------------------------------------------------------------------------------------
>
> Key: DERBY-4156
> URL: https://issues.apache.org/jira/browse/DERBY-4156
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.5.1.0
> Environment: - Windows Vista x64
> - Sun Java 6
> Reporter: Tiago R. Espinha
>
> While doing the buddy testing for the SQL roles, I believe I have found a bug.
> Reproduction:
> ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
> ij> create table t1 (f1 int, f2 varchar(200));
> 0 rows inserted/updated/deleted
> ij> create role testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant select on t1 to testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant testCreateFirst to tiago;
> 0 rows inserted/updated/deleted
> ij> grant update on t1 to testWithoutCreate;
> 0 rows inserted/updated/deleted
> ij> grant testWithoutCreate to adm;
> ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
> ij> create role testWithoutCreate;
> ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
> ---------------------8<----------------------
> This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
> The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
> Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (DERBY-4156) SQL Roles - Granting privileges to a
role before creating it generates weird behavior
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-4156?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas closed DERBY-4156.
--------------------------------
Resolution: Invalid
Hi Tiago,
This behavior is decidely weird, but it is expected. What you have run across is another symptom of Derby's lack of user management. This particular issue is discussed in section 6.2 of the functional spec attached to the master roles issue, DERBY-2207. You have tripped across one of the speedbumps at the intersection of two awkward facts:
1) The ANSI/ISO GRANT/REVOKE language does not distinguish the rolename and username spaces. Role names and user names live in a single, conflated namespace called "authorization ids". So, just looking at a GRANT/REVOKE statement, you can't tell whether it wants to operate on a role or a user.
2) Derby's flexible authentication scheme does not give you any foolproof way to figure out if an authorization id is the name of an existing user.
Here's what's going on in your problem case:
1) Derby interprets your "grant update on t1 to testWithoutCreate" statement as a privilege GRANT to a user named TESTWITHOUTCREATE. At this time, Derby creates a permission tuple to record this GRANT.
2) When you then try to create a role named TESTWITHOUTCREATE, Derby looks to see if there will be any collisions with that authorization id. Derby sees that a permission has already been granted to that authorization id so that authorization id is not available as the name of a new role.
> SQL Roles - Granting privileges to a role before creating it generates weird behavior
> -------------------------------------------------------------------------------------
>
> Key: DERBY-4156
> URL: https://issues.apache.org/jira/browse/DERBY-4156
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.5.1.0
> Environment: - Windows Vista x64
> - Sun Java 6
> Reporter: Tiago R. Espinha
> Attachments: derby.properties
>
>
> While doing the buddy testing for the SQL roles, I believe I have found a bug.
> Reproduction:
> ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
> ij> create table t1 (f1 int, f2 varchar(200));
> 0 rows inserted/updated/deleted
> ij> create role testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant select on t1 to testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant testCreateFirst to tiago;
> 0 rows inserted/updated/deleted
> ij> grant update on t1 to testWithoutCreate;
> 0 rows inserted/updated/deleted
> ij> grant testWithoutCreate to adm;
> ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
> ij> create role testWithoutCreate;
> ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
> ---------------------8<----------------------
> This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
> The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
> Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-4156) SQL Roles - Granting privileges to a
role before creating it generates weird behavior
Posted by "Tiago R. Espinha (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-4156?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tiago R. Espinha updated DERBY-4156:
------------------------------------
Description:
While doing the buddy testing for the SQL roles, I believe I have found a bug.
Reproduction:
ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
ij> create table t1 (f1 int, f2 varchar(200));
0 rows inserted/updated/deleted
ij> create role testCreateFirst;
0 rows inserted/updated/deleted
ij> grant select on t1 to testCreateFirst;
0 rows inserted/updated/deleted
ij> grant testCreateFirst to tiago;
0 rows inserted/updated/deleted
ij> grant update on t1 to testWithoutCreate;
0 rows inserted/updated/deleted
ij> grant testWithoutCreate to adm;
ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
ij> create role testWithoutCreate;
ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
was:
While doing the buddy testing for the SQL roles, I believe I have found a bug.
Reproduction:
ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;cr
eate=true';
ij> create table t1 (f1 int, f2 varchar(200));
0 rows inserted/updated/deleted
ij> create role testCreateFirst;
0 rows inserted/updated/deleted
ij> grant select on t1 to testCreateFirst;
0 rows inserted/updated/deleted
ij> grant testCreateFirst to tiago;
0 rows inserted/updated/deleted
ij> grant update on t1 to testWithoutCreate;
0 rows inserted/updated/deleted
ij> grant testWithoutCreate to adm;
ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
ij> create role testWithoutCreate;
ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
> SQL Roles - Granting privileges to a role before creating it generates weird behavior
> -------------------------------------------------------------------------------------
>
> Key: DERBY-4156
> URL: https://issues.apache.org/jira/browse/DERBY-4156
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.5.1.0
> Environment: - Windows Vista x64
> - Sun Java 6
> Reporter: Tiago R. Espinha
>
> While doing the buddy testing for the SQL roles, I believe I have found a bug.
> Reproduction:
> ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
> ij> create table t1 (f1 int, f2 varchar(200));
> 0 rows inserted/updated/deleted
> ij> create role testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant select on t1 to testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant testCreateFirst to tiago;
> 0 rows inserted/updated/deleted
> ij> grant update on t1 to testWithoutCreate;
> 0 rows inserted/updated/deleted
> ij> grant testWithoutCreate to adm;
> ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
> ij> create role testWithoutCreate;
> ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
> This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
> The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
> Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-4156) SQL Roles - Granting privileges to a
role before creating it generates weird behavior
Posted by "Tiago R. Espinha (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-4156?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tiago R. Espinha updated DERBY-4156:
------------------------------------
Attachment: derby.properties
Attaching my derby.properties file
> SQL Roles - Granting privileges to a role before creating it generates weird behavior
> -------------------------------------------------------------------------------------
>
> Key: DERBY-4156
> URL: https://issues.apache.org/jira/browse/DERBY-4156
> Project: Derby
> Issue Type: Bug
> Components: SQL
> Affects Versions: 10.5.1.0
> Environment: - Windows Vista x64
> - Sun Java 6
> Reporter: Tiago R. Espinha
> Attachments: derby.properties
>
>
> While doing the buddy testing for the SQL roles, I believe I have found a bug.
> Reproduction:
> ij> connect 'jdbc:derby://localhost:1527/testro;user=tiago2;password=alentejo;create=true';
> ij> create table t1 (f1 int, f2 varchar(200));
> 0 rows inserted/updated/deleted
> ij> create role testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant select on t1 to testCreateFirst;
> 0 rows inserted/updated/deleted
> ij> grant testCreateFirst to tiago;
> 0 rows inserted/updated/deleted
> ij> grant update on t1 to testWithoutCreate;
> 0 rows inserted/updated/deleted
> ij> grant testWithoutCreate to adm;
> ERROR 0P000: Invalid role specification, role does not exist: 'TESTWITHOUTCREATE'.
> ij> create role testWithoutCreate;
> ERROR X0Y68: User 'TESTWITHOUTCREATE' already exists.
> ---------------------8<----------------------
> This reproduction was made on a freshly created database. Basically I created the table, then created a role and gave it SELECT privileges on that table. Finally I granted the said role to a user (I'm using built-in authentication) and it all went smoothly.
> The problem came when I accidentally forgot to create a role and proceeded to grant privileges to that role. So when we grant some privilege to a non-existing role, instead of getting an error it all seems to go fine. It is when we try to grant this role to a user that we are told that the role does not exist, which makes sense. Still, when I try to create that role afterwards, I get an error message saying that an ->user<- with this username already exists.
> Granting privileges to a non-existing role should issue an error and instead it is probably causing some havoc in the database.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.