Issue Details (XML | Word | Printable)

Key: CORE-6329
Type: Bug Bug
Status: Closed Closed
Resolution: Fixed
Priority: Major Major
Assignee: Alexander Peshkov
Reporter: Sven-Eric Matthes
Votes: 0
Watchers: 4

If you were logged in you would be able to see more operations.
Firebird Core

GBAK with service_mgr and WinSSPI authentication for Windows SYSTEM user producing error in clumplet API

Created: 09/Jun/20 11:05 AM   Updated: 18/Jun/20 07:10 PM
Component/s: GBAK
Affects Version/s: 3.0.5
Fix Version/s: 3.0.6, 4.0 RC 1

Environment: Windows Server 2016

QA Status: Done successfully

 Description  « Hide

last year I configured our databases for backups without having to write our SYSDBA credentials in our backup script. Here I used Trusted Authentication via the WinSSPI Plugin and mapped the Windows SYSTEM user to SYSDBA via Global Mapping. We don't want our credentials in the script files because of security policies.

This is the mapping I created:

I could then create or restore a backup by running my backup script as Windows System User without SYSDBA credentials. This worked just fine with Firebird 3.0.4. Now I updated our Test environment to Firebird 3.0.5 and I'm getting an error in the clumplet API.

For example when restoring a backup it returns this:
gbak.exe -r -se localhost/3050:service_mgr -v -y D:\Backup\SomeDB.log D:\Backup\SomeDB.fbk D:\Database\SomeDB.fdb
gbak: ERROR:Internal error when using clumplet API: attempt to store 447 bytes in a clumplet with maximum size 255 bytes
gbak:Exiting before completion due to errors

The same error happens if I create backups like this:
gbak.exe -b -v -y D:\Backup\SomeDB.log D:\Database\SomeDB.fdb E:\Backup\SomeDB.fbk

If I backup or restore without service_mgr it works, but then it takes a lot longer!

Did something break here?

 All   Comments   Change History   Subversion Commits      Sort Order: Ascending order - Click to sort in descending order
Alexander Peshkov added a comment - 17/Jun/20 04:56 PM
That's not plugin or windows specific issue - but in this particular environment after adding ability to map any windows group to firebird role a kind of overflow (luckily detected with something better than segfault on server) has happened.