You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Juha Heljoranta (JIRA)" <ji...@apache.org> on 2007/03/20 14:03:32 UTC
[jira] Created: (DERBY-2470) No authentication required to restore
a backup
No authentication required to restore a backup
----------------------------------------------
Key: DERBY-2470
URL: https://issues.apache.org/jira/browse/DERBY-2470
Project: Derby
Issue Type: Bug
Components: Security
Affects Versions: 10.2.2.0
Environment: Java 1.6.0-b105
Linux 2.6.20 i686
Reporter: Juha Heljoranta
My Derby has following properties set:
derby.connection.requireAuthentication=true
derby.authentication.provider=BUILTIN
derby.database.defaultConnectionMode=noAccess
derby.database.fullAccessUsers=foo
derby.user.foo=bar
If I'll execute a restore statement from ij the backup will be restored plus it gives an authentication error:
ij> connect 'jdbc:derby:sample;restoreFrom=backup1';
ERROR 08004: Connection refused : Invalid authentication
If I add the user and password arguments to the url then the restore works as before without the error message.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2470) No authentication required to restore
a backup
Posted by "Dag H. Wanvik (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2470?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Dag H. Wanvik updated DERBY-2470:
---------------------------------
Component/s: Tools
> No authentication required to restore a backup
> ----------------------------------------------
>
> Key: DERBY-2470
> URL: https://issues.apache.org/jira/browse/DERBY-2470
> Project: Derby
> Issue Type: Bug
> Components: Tools
> Affects Versions: 10.2.2.0
> Environment: Java 1.6.0-b105
> Linux 2.6.20 i686
> Reporter: Juha Heljoranta
>
> My Derby has following properties set:
> derby.connection.requireAuthentication=true
> derby.authentication.provider=BUILTIN
> derby.database.defaultConnectionMode=noAccess
> derby.database.fullAccessUsers=foo
> derby.user.foo=bar
> If I'll execute a restore statement from ij the backup will be restored plus it gives an authentication error:
> ij> connect 'jdbc:derby:sample;restoreFrom=backup1';
> ERROR 08004: Connection refused : Invalid authentication
> If I add the user and password arguments to the url then the restore works as before without the error message.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (DERBY-2470) No authentication required to restore
a backup
Posted by "Rick Hillegas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2470?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rick Hillegas updated DERBY-2470:
---------------------------------
Urgency: Normal
Triaged for 10.5.2: assigned normal urgency.
> No authentication required to restore a backup
> ----------------------------------------------
>
> Key: DERBY-2470
> URL: https://issues.apache.org/jira/browse/DERBY-2470
> Project: Derby
> Issue Type: Bug
> Components: Tools
> Affects Versions: 10.2.2.0
> Environment: Java 1.6.0-b105
> Linux 2.6.20 i686
> Reporter: Juha Heljoranta
>
> My Derby has following properties set:
> derby.connection.requireAuthentication=true
> derby.authentication.provider=BUILTIN
> derby.database.defaultConnectionMode=noAccess
> derby.database.fullAccessUsers=foo
> derby.user.foo=bar
> If I'll execute a restore statement from ij the backup will be restored plus it gives an authentication error:
> ij> connect 'jdbc:derby:sample;restoreFrom=backup1';
> ERROR 08004: Connection refused : Invalid authentication
> If I add the user and password arguments to the url then the restore works as before without the error message.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (DERBY-2470) No authentication required to
restore a backup
Posted by "Dag H. Wanvik (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/DERBY-2470?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12484573 ]
Dag H. Wanvik commented on DERBY-2470:
--------------------------------------
Discussed this issue a bit with Rick off line, and came to the conclusion
that this action should probably be protected by system privileges. The reasoning is
as follows: a) If there is no database at the url location, this is really a create database
operation. b) if there is an existing database in the url location, the operation involves
more than a single database: Only the latter seems the right scope for database level
privileges.
If one did consider checking against database level (owner) privileges, which database
image should determine the ownership of the database, the backup or the url image?
(While we can not change ownership right now, that might change.)
It seems cleaner to me to make this a system level privilege (DERBY-2109).
Linking this issue to DERBY-2109 for reference.
> No authentication required to restore a backup
> ----------------------------------------------
>
> Key: DERBY-2470
> URL: https://issues.apache.org/jira/browse/DERBY-2470
> Project: Derby
> Issue Type: Bug
> Components: Security
> Affects Versions: 10.2.2.0
> Environment: Java 1.6.0-b105
> Linux 2.6.20 i686
> Reporter: Juha Heljoranta
>
> My Derby has following properties set:
> derby.connection.requireAuthentication=true
> derby.authentication.provider=BUILTIN
> derby.database.defaultConnectionMode=noAccess
> derby.database.fullAccessUsers=foo
> derby.user.foo=bar
> If I'll execute a restore statement from ij the backup will be restored plus it gives an authentication error:
> ij> connect 'jdbc:derby:sample;restoreFrom=backup1';
> ERROR 08004: Connection refused : Invalid authentication
> If I add the user and password arguments to the url then the restore works as before without the error message.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.