Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

grant create database to ROLE doesn`t work: "no permission for CREATE access to DATABASE ..." [CORE4821] #5118

Closed
firebird-automations opened this issue May 30, 2015 · 23 comments
Closed

grant create database to ROLE doesn`t work: "no permission for CREATE access to DATABASE ..." [CORE4821] #5118

firebird-automations opened this issue May 30, 2015 · 23 comments
Assignees
@AlexPeshkoff
Labels
component: security fix-version: 3.0 Beta 2 priority: major qa: done successfully type: bug

Comments

@firebird-automations
Copy link
Collaborator

Submitted by: @pavel-zotov

Prepare:

set bail on;
shell del c:\temp\e30_bill_scott.fdb 2>nul;
set wng off;

set term ^;
execute block as
begin
begin execute statement 'drop role db_creator'; when any do begin end end
end^
set term ;^
commit;

create or alter user bill_scott password '123';
create role db_creator;
commit;

revoke all on all from bill_scott;
revoke all on all from role db_creator;
commit;

grant create database to role db_creator;
grant db_creator to bill_scott;
--grant rdb$admin to bill_scott;

commit;

show grants;
commit;

EXIT;

Output:

/* Grant permissions for this database */
GRANT DB_CREATOR TO BILL_SCOTT
GRANT CREATE DATABASE TO ROLE DB_CREATOR

Run (isql -q -i <name.sql>):

set bail on;
set echo on;
connect 'localhost/3333:e30' user 'bill_scott' password '123' role 'DB_CREATOR';

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;
commit;

create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';
commit;

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;
commit;
drop database;

STDOUT:

connect 'localhost/3333:e30' user 'bill_scott' password '123' role 'DB_CREATOR';

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;

USER BILL_SCOTT
ROLE DB_CREATOR
MON$DATABASE_NAME C:\FBTESTING\qa\fbt-repo\tmp\E30.fdb
. . .
MON$OWNER SYSDBA
MON$SEC_DATABASE Default
. . .
MON$USER BILL_SCOTT
MON$ROLE DB_CREATOR
MON$REMOTE_PROTOCOL TCPv4
MON$REMOTE_ADDRESS 127.0.0.1
. . .
MON$REMOTE_PROCESS C:\1INSTALL\FIREBIRD\fb30sS\isql.exe
MON$CLIENT_VERSION WI-T3.0.0.31845 Firebird 3.0 Beta 2
MON$REMOTE_VERSION P13
MON$REMOTE_HOST balaha
MON$REMOTE_OS_USER john smith
MON$AUTH_METHOD Srp
MON$SYSTEM_FLAG 0

commit;

create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';

STDERR:

Statement failed, SQLSTATE = 28000
no permission for CREATE access to DATABASE C:\TEMP\E30_BILL_SCOTT.FDB

(on attempt to perform statement: "create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';").

PS. firebird.conf:

RemoteServicePort = 3333
SharedCache = true
SharedDatabase = false
DefaultDbCachePages = 2048

AuthClient = Srp,Legacy_Auth,Win_Sspi
AuthServer = Srp,Legacy_Auth

ExternalFileAccess = Restrict C:\1INSTALL\FIREBIRD\FB30SNAP

FileSystemCacheThreshold = 65536K
LockHashSlots = 22111
MaxUserTraceLogSize = 99999

UserManager = Srp
#⁠WireCrypt = Disabled

FB version: WI-T3.0.0.31845

Commits: 4e9539b 5dff2e4 FirebirdSQL/fbt-repository@5c64038 FirebirdSQL/fbt-repository@c37bb38

====== Test Details ======

::: NOTE ::: Test requires that databases.conf contains 'RemoteAccess = true' for security.db
This line is added there by scenario '<QA_HOME>\rundaily.bat' every time when check new FB snapshot.
@firebird-automations
Copy link
Collaborator Author

Modified by: @pavel-zotov

description: Prepare:

set bail on;
shell del c:\temp\e30_bill_scott.fdb 2>nul;
set wng off;

set term ^;
execute block as
begin
begin execute statement 'drop role db_creator'; when any do begin end end
end^
set term ;^
commit;

create or alter user bill_scott password '123';
create role db_creator;
commit;

revoke all on all from bill_scott;
revoke all on all from role db_creator;
commit;

grant create database to role db_creator;
grant db_creator to bill_scott;
--grant rdb$admin to bill_scott;

commit;

show grants;
commit;

EXIT;

Output:

/* Grant permissions for this database */
GRANT DB_CREATOR TO BILL_SCOTT
GRANT CREATE DATABASE TO ROLE DB_CREATOR

Run:

set bail on;
set echo on;
connect 'localhost/3333:e30' user 'bill_scott' password '123' role 'DB_CREATOR';

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;
commit;

create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';
commit;

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;
commit;
drop database;

STDOUT:

connect 'localhost/3333:e30' user 'bill_scott' password '123' role 'DB_CREATOR';

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;

USER BILL_SCOTT
ROLE DB_CREATOR
MON$DATABASE_NAME C:\FBTESTING\qa\fbt-repo\tmp\E30.fdb
. . .
MON$OWNER SYSDBA
MON$SEC_DATABASE Default
. . .
MON$USER BILL_SCOTT
MON$ROLE DB_CREATOR
MON$REMOTE_PROTOCOL TCPv4
MON$REMOTE_ADDRESS 127.0.0.1
. . .
MON$REMOTE_PROCESS C:\1INSTALL\FIREBIRD\fb30sS\isql.exe
MON$CLIENT_VERSION WI-T3.0.0.31845 Firebird 3.0 Beta 2
MON$REMOTE_VERSION P13
MON$REMOTE_HOST balaha
MON$REMOTE_OS_USER john smith
MON$AUTH_METHOD Srp
MON$SYSTEM_FLAG 0

commit;

create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';

STDERR:

Statement failed, SQLSTATE = 28000
no permission for CREATE access to DATABASE C:\TEMP\E30_BILL_SCOTT.FDB

(on attempt to perform statement: "create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';").

PS. firebird.conf:

RemoteServicePort = 3330
SharedCache = false
SharedDatabase = true
DefaultDbCachePages = 256

AuthClient = Srp,Legacy_Auth,Win_Sspi
AuthServer = Srp,Legacy_Auth

ExternalFileAccess = Restrict C:\1INSTALL\FIREBIRD\FB30SNAP

FileSystemCacheThreshold = 65536K
LockHashSlots = 22111
MaxUserTraceLogSize = 99999

UserManager = Srp
#⁠WireCrypt = Disabled

FB version: WI-T3.0.0.31845

=>

Prepare:

set bail on;
shell del c:\temp\e30_bill_scott.fdb 2>nul;
set wng off;

set term ^;
execute block as
begin
begin execute statement 'drop role db_creator'; when any do begin end end
end^
set term ;^
commit;

create or alter user bill_scott password '123';
create role db_creator;
commit;

revoke all on all from bill_scott;
revoke all on all from role db_creator;
commit;

grant create database to role db_creator;
grant db_creator to bill_scott;
--grant rdb$admin to bill_scott;

commit;

show grants;
commit;

EXIT;

Output:

/* Grant permissions for this database */
GRANT DB_CREATOR TO BILL_SCOTT
GRANT CREATE DATABASE TO ROLE DB_CREATOR

Run (isql -q -i <name.sql>):

set bail on;
set echo on;
connect 'localhost/3333:e30' user 'bill_scott' password '123' role 'DB_CREATOR';

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;
commit;

create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';
commit;

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;
commit;
drop database;

STDOUT:

connect 'localhost/3333:e30' user 'bill_scott' password '123' role 'DB_CREATOR';

set list on; select current_user, current_role, m.*, a.* from mon$database m join mon$attachments a on a.mon$attachment_id = current_connection;

USER BILL_SCOTT
ROLE DB_CREATOR
MON$DATABASE_NAME C:\FBTESTING\qa\fbt-repo\tmp\E30.fdb
. . .
MON$OWNER SYSDBA
MON$SEC_DATABASE Default
. . .
MON$USER BILL_SCOTT
MON$ROLE DB_CREATOR
MON$REMOTE_PROTOCOL TCPv4
MON$REMOTE_ADDRESS 127.0.0.1
. . .
MON$REMOTE_PROCESS C:\1INSTALL\FIREBIRD\fb30sS\isql.exe
MON$CLIENT_VERSION WI-T3.0.0.31845 Firebird 3.0 Beta 2
MON$REMOTE_VERSION P13
MON$REMOTE_HOST balaha
MON$REMOTE_OS_USER john smith
MON$AUTH_METHOD Srp
MON$SYSTEM_FLAG 0

commit;

create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';

STDERR:

Statement failed, SQLSTATE = 28000
no permission for CREATE access to DATABASE C:\TEMP\E30_BILL_SCOTT.FDB

(on attempt to perform statement: "create database 'localhost/3333:c:\temp\e30_bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';").

PS. firebird.conf:

RemoteServicePort = 3333
SharedCache = true
SharedDatabase = false
DefaultDbCachePages = 2048

AuthClient = Srp,Legacy_Auth,Win_Sspi
AuthServer = Srp,Legacy_Auth

ExternalFileAccess = Restrict C:\1INSTALL\FIREBIRD\FB30SNAP

FileSystemCacheThreshold = 65536K
LockHashSlots = 22111
MaxUserTraceLogSize = 99999

UserManager = Srp
#⁠WireCrypt = Disabled

FB version: WI-T3.0.0.31845

@firebird-automations
Copy link
Collaborator Author

Commented by: @dyemanov

How is this supposed to work? Roles exist inside the database, but it's not created yet.

@firebird-automations
Copy link
Collaborator Author

Commented by: @pavel-zotov

doc\sql.extensions\README.ddl_access.txt says:

...
For database access special form is supported:

GRANT CREATE DATABASE TO [USER | ROLE] <user/role name>;
...

For what 'ROLE' is mentioned here if it is impossible do to that ?

@firebird-automations
Copy link
Collaborator Author

Commented by: @dyemanov

BTW, shouldn't the ROLE clause be prohibited for a CREATE DATABASE statement, as it can never be enforced? Well, it can be for RDB$ADMIN, but the database creator is already DBO which means the same level of privileges. Or maybe we should silently create the given role while creating the database, grant it to the database creator and activate for the CREATE DATABASE connection?

As for granting CREATE DATABASE to some role, I don't see how it could work at all. But maybe I'm missing something. Let's wait for Alex's explanations.

@firebird-automations
Copy link
Collaborator Author

Commented by: @romansimakov

In RedDatabase we have "global role" which is a role living in security2.fdb (any system catalog). It's natural to keep not only users and their privileges in some system catalog but roles as well. No? I hope we can find some general solution for FB 3 to implement something like "global roles".

@firebird-automations
Copy link
Collaborator Author

Modified by: @AlexPeshkoff

assignee: Alexander Peshkov [ alexpeshkoff ]

@firebird-automations
Copy link
Collaborator Author

Commented by: @AlexPeshkoff

Role can be granted in security database, it's checked and used when CREATE DATABASE is executed. After it you can execute target statement. I.e. (use embedded access to security db):

#⁠ ./isql security.db
Database: security.db
SQL> show grant;

/* Grant permissions for this database */
..... --other grants
GRANT DB_CREATOR TO BILL_SCOTT
GRANT CREATE DATABASE TO ROLE DB_CREATOR
SQL> <ctrl-D>

localhost bin #⁠ ./isql
Use CONNECT or CREATE DATABASE to specify a database
SQL> create database 'localhost:/tmp/bill_scott.fdb' user 'bill_scott' password '123' role 'DB_CREATOR';
SQL>

@firebird-automations
Copy link
Collaborator Author

Commented by: @AlexPeshkoff

What should be fixed on my mind - prevent issuing GRANT CREATE DATABASE TO ROLE when there is no such role in security database.

@firebird-automations
Copy link
Collaborator Author

Commented by: @AlexPeshkoff

Ensure CREATE DATABASE right is granted only to roles that do exist in security database

@firebird-automations
Copy link
Collaborator Author

Modified by: @AlexPeshkoff

status: Open [ 1 ] => Resolved [ 5 ]

resolution: Fixed [ 1 ]

Fix Version: 3.0 Beta 2 [ 10586 ]

@firebird-automations
Copy link
Collaborator Author

Commented by: @pavel-zotov

> Role can be granted in security database, it's checked and used when CREATE DATABASE is executed. After it you can execute target statement.

Alex, I can`t understand what I'm doing wrong but the following script has no effect: user who is granted role DB_CREATOR still can`t create database.

-- First, make embedded connect to sec3.fdb, create role and user there and make grants:

C:\1INSTALL\FIREBIRD\fb30sC>C:\1INSTALL\FIREBIRD\fb30sC\isql.exe security3.fdb
Database: security3.fdb
SQL> set term ^;
SQL> execute block as
CON> begin
CON> execute statement 'drop role db_creator';
CON> when any do begin end
CON> end
CON> ^
SQL> set term ;^
SQL> commit;
SQL> create role db_creator; ----------------------------------------- [ 1 ]
SQL> commit;
SQL> create or alter user almost_dba password '123'; ------- [ 2 ]
SQL> commit;
SQL> grant create database to role db_creator; ----------------- [ 3 ]
SQL> grant db_creator to almost_dba; ----------------------------- [ 4 ]
SQL> commit;
SQL> show grants;

Output:
<. . . skipped several lines related to default settings . . .>
GRANT DB_CREATOR TO ALMOST_DBA GRANTED BY SYSDBA
GRANT CREATE DATABASE TO ROLE DB_CREATOR

SQL> show role;
DB_CREATOR
SQL> show role db_creator;
Role DB_CREATOR is granted to:
ALMOST_DBA

So, the role DOES exists in sec3.fdb and was granted to CREATE DATABASE privilege.

-- Then I reconnect using remote protocol and do:

SQL> connect 'localhost/3330:e30' user 'almost_dba' password '123' role 'DB_CREATOR';
Database: 'localhost/3330:e30', User: almost_dba, Role: DB_CREATOR
SQL> set list on;
SQL> select current_user,current_role from rdb$database;

USER ALMOST_DBA
ROLE NONE

SQL> commit; connect 'localhost/3330:e30' user 'almost_dba' password '123' role 'db_creator';
Database: 'localhost/3330:e30', User: almost_dba, Role: db_creator
SQL> select current_user,current_role from rdb$database;

USER ALMOST_DBA
ROLE NONE

SQL> show grants;

/* Grant permissions for this database */
GRANT CREATE DATABASE TO ROLE DB_CREATOR
SQL> show role;
There are no roles in this database
SQL>

Output says that we can`t connect with role 'DB_CREATOR' -- AFAIU, just becase this role does not exist in the database with alias = 'e30'.
OK, create this role also here:

SQL> commit; connect 'localhost/3330:e30' user 'sysdba' password 'masterke';
SQL> create role db_creator;
SQL> commit;
SQL> grant db_creator to almost_dba;
SQL> commit;
SQL> connect 'localhost/3330:e30' user 'almost_dba' password '123' role 'db_creator';
Database: 'localhost/3330:e30', User: almost_dba, Role: db_creator
SQL> select current_user,current_role from rdb$database;

USER ALMOST_DBA
ROLE NONE

Actual role is still "NONE". Why ? What should be changed in this script in order to give user 'almost_dba' ability to create new database WITHOUT direct privilege but instead - through the role.

@firebird-automations
Copy link
Collaborator Author

Commented by: @AlexPeshkoff

>
>-- Then I reconnect using remote protocol and do:
>
>SQL> connect 'localhost/3330:e30' user 'almost_dba' password '123' role 'DB_CREATOR';
>Database: 'localhost/3330:e30', User: almost_dba, Role: DB_CREATOR
>

And what client do you use? With current FB3 you should not be able to connect this way. You will get:

Statement failed, SQLSTATE = 28000
Your user name and password are not defined. Ask your database administrator to set up a Firebird login.

Correct ways are:

SQL> connect 'localhost:employee' user almost_dba password '123' role 'DB_CREATOR';
Database: 'localhost:employee', User: almost_dba, Role: DB_CREATOR
SQL>

or

SQL> connect 'localhost:employee' user 'ALMOST_DBA' password '123' role 'DB_CREATOR';
Database: 'localhost:employee', User: 'ALMOST_DBA', Role: DB_CREATOR
SQL>

BTW, the following works:

#⁠ ./isql
Use CONNECT or CREATE DATABASE to specify a database
SQL> CREATE DATABASE 'localhost:123.fdb' user almost_dba password '123' role db_creator;
SQL> show database;
Database: localhost:123.fdb
Owner: ALMOST_DBA
DB = /tmp/123.fdb
...

@firebird-automations
Copy link
Collaborator Author

Commented by: @pavel-zotov

> And what client do you use? With current FB3 you should not be able to connect this way. You will get: Statement failed, SQLSTATE = 28000

You're right: since build 31868 one need specify login in UPPER_CASE if this login was created without double quotes, i.e. like this:

> create or alter user almost_dba password '123'; ------- [ 2 ]

But please note: I just repeated step of creating user 'almost_dba' and role and granting role to him on empty new database:
...
SQL> commit;
SQL> create role db_creator; ----------------------------------------- [ 1 ]
SQL> commit;
SQL> create or alter user almost_dba password '123'; ------- [ 2 ]
SQL> commit;
SQL> grant create database to role db_creator; ----------------- [ 3 ]
SQL> grant db_creator to almost_dba; ----------------------------- [ 4 ]
SQL> commit;
SQL> show grants;

-- and than do following:

SQL> exit;

C:\MIX\firebird\QA\fbt-repo\tmp>C:\MIX\firebird\fb30sc\isql.exe
Use CONNECT or CREATE DATABASE to specify a database
SQL> connect 'localhost/3330:e30' user 'almost_dba' password '123' role 'DB_CREATOR';
Statement failed, SQLSTATE = 28000
Your user name and password are not defined. Ask your database administrator to set up a Firebird login.

// YES, it's that SHOULD be on current FB build.

SQL> connect 'localhost/3330:e30' user 'ALMOST_DBA' password '123' role 'DB_CREATOR'; ----- login in U.P.P.E.R. case
Database: 'localhost/3330:e30', User: 'ALMOST_DBA', Role: DB_CREATOR
SQL> set list on;
SQL> select current_user,current_role from rdb$database;

USER ALMOST_DBA
ROLE NONE -------------------------------------- WHY ??

SQL> show version;
ISQL Version: WI-T3.0.0.31868 Firebird 3.0 Beta 2
Server version:
Firebird/Windows/Intel/i386 (access method), version "WI-T3.0.0.31868 Firebird 3.0 Beta 2"
Firebird/Windows/Intel/i386 (remote server), version "WI-T3.0.0.31868 Firebird 3.0 Beta 2/tcp (csprog)/P13"
Firebird/Windows/Intel/i386 (remote interface), version "WI-T3.0.0.31868 Firebird 3.0 Beta 2/tcp (csprog)/P13"
on disk structure version 12.0
SQL>

@firebird-automations
Copy link
Collaborator Author

Commented by: @pavel-zotov

... and specifying ROLE in lowercase (as it was in CREATE ROLE statement, see above) - also doesn`t help:

SQL> commit;
SQL> connect 'localhost/3330:e30' user 'ALMOST_DBA' password '123' role 'db_creator';
Database: 'localhost/3330:e30', User: 'ALMOST_DBA', Role: db_creator
SQL> select current_user,current_role from rdb$database;

USER ALMOST_DBA
ROLE NONE

@firebird-automations
Copy link
Collaborator Author

Commented by: @sim1984

In order that the user entered with a role, this role should be created in this database to be connected. Ie it is necessary to create a role not only in security3.fdb, but also in the database. The role was created in security3.fdb can only specify in the statement CREATE DATABASE. At this point in the CREATE DATABASE statement only makes sense to specify the role RDB$ADMIN.

@firebird-automations
Copy link
Collaborator Author

Commented by: @pavel-zotov

If role is created in order to have ability of anyone who is granted with it to CREATE DATABASE than this role should be created like this:

SQL> create role db_creator2 grant admin role; --- similar to create user ... password ... grant admin role

But current syntax doesn`t allow it:

Statement failed, SQLSTATE = 42000
Dynamic SQL Error
-SQL error code = -104
-Token unknown - line 1, column 25
-grant

@firebird-automations
Copy link
Collaborator Author

Commented by: @sim1984

So far, the FB is not possible to assign roles to another role. See CORE1815

@firebird-automations
Copy link
Collaborator Author

Commented by: @pavel-zotov

This isnot asignment, it is like boolean flag that indicates place where this role will be stored.
Syntax could be more clear if one might to do like this:

#⁠ ./isql remote_host/3050:path/my_database.fdb -q -user SYSDBA -pas masterkey
SQL> CREATE ROLE DB_CREATOR STORE IN SECURITY DATABASE; -- this mean that role will be created in SEC3.FDB
SQL> COMMIT;
SQL> CREATE USER BILL_SCOTT PASSWORD '123';
SQL> GRANT CREATE DATABASE TO DB_CREATOR; -- this will add record in rdb$privileges from SEC3.FDB rather than from my_database.fdb
SQL> GRANT DB_CREATOR TO BILL_SCOTT; -- this also add record in rdb$privileges from SEC3.FDB

@firebird-automations
Copy link
Collaborator Author

Modified by: @pavel-zotov

status: Resolved [ 5 ] => Resolved [ 5 ]

QA Status: No test => Deferred

Test Details: Wait untill Alex solution for some questions about possible implementation, see letter 11-jun-2015 12:57.

@firebird-automations
Copy link
Collaborator Author

Modified by: @pavel-zotov

status: Resolved [ 5 ] => Resolved [ 5 ]

Test Details: Wait untill Alex solution for some questions about possible implementation, see letter 11-jun-2015 12:57. => Wait untill Alex solution for some questions about possible implementation, see letter 11-jun-2015 12:57.
[upd]
set term ^;
execute block as
begin
execute statement 'drop role db_maker';
when any do begin end
end
^
set term ;^
commit;
create role db_maker;
commit;
create or alter user tmp$c4821 password '123' revoke admin role;

-- Following GRANT statement will fail with:
-- -GRANT failed
-- -SQL role DB_MAKER does not exist
-- -in security database
grant create database to role db_maker;

grant db_maker to tmp$c4821;
commit;
show grants;

@firebird-automations
Copy link
Collaborator Author

Modified by: @pavel-zotov

status: Resolved [ 5 ] => Resolved [ 5 ]

QA Status: Deferred => Done successfully

Test Details: Wait untill Alex solution for some questions about possible implementation, see letter 11-jun-2015 12:57.
[upd]
set term ^;
execute block as
begin
execute statement 'drop role db_maker';
when any do begin end
end
^
set term ;^
commit;
create role db_maker;
commit;
create or alter user tmp$c4821 password '123' revoke admin role;

-- Following GRANT statement will fail with:
-- -GRANT failed
-- -SQL role DB_MAKER does not exist
-- -in security database
grant create database to role db_maker;

grant db_maker to tmp$c4821;
commit;
show grants;

=>

@firebird-automations
Copy link
Collaborator Author

Modified by: @pavel-zotov

status: Resolved [ 5 ] => Closed [ 6 ]

@firebird-automations
Copy link
Collaborator Author

Modified by: @pavel-zotov

status: Closed [ 6 ] => Closed [ 6 ]

Test Details: ::: NOTE ::: Test requires that databases.conf contains 'RemoteAccess = true' for security.db
This line is added there by scenario '<QA_HOME>\rundaily.bat' every time when check new FB snapshot.

Test Specifics: [Custom configuration required]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@AlexPeshkoff AlexPeshkoff

Labels
component: security fix-version: 3.0 Beta 2 priority: major qa: done successfully type: bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@AlexPeshkoff @firebird-automations