You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When using Role Based Whitelisting with the following setup:
Given user/role kalle_wl wihch is granted all permissions to table ks.test: cassandra@cqlsh> grant all on TABLE ks.test TO kalle_wl;
And the user/role is whitelisted for the ks.test table: cassandra@cqlsh> ALTER ROLE kalle_wl WITH OPTIONS = { 'GRANT AUDIT WHITELIST FOR ALL' : 'data/ks/test' };
Gives the following permissions:
cassandra@cqlsh> list all PERMISSIONS of kalle_wl;
role | username | resource | permission
----------+----------+-----------------+------------
kalle_wl | kalle_wl | <table ks.test> | ALTER
kalle_wl | kalle_wl | <table ks.test> | DROP
kalle_wl | kalle_wl | <table ks.test> | SELECT
kalle_wl | kalle_wl | <table ks.test> | MODIFY
kalle_wl | kalle_wl | <table ks.test> | AUTHORIZE
Gives the role options:
cassandra@cqlsh> list roles;
role | super | login | options
-----------+-------+-------+--------------------------------------------------------------------------
cassandra | True | True | {}
kalle_wl | False | False | {'AUDIT WHITELIST ON data/ks/test': 'ALTER,DROP,SELECT,MODIFY,AUTHORIZE'}
When the table is dropped: cassandra@cqlsh> DROP TABLE ks.test ;
Then the permission for that table is removed:
cassandra@cqlsh> list all PERMISSIONS of kalle_wl ;
role | resource | permissions
------+----------+-------------
BUT the whitelist-data for that user is not removed:
cassandra@cqlsh> list roles;
role | super | login | options
-----------+-------+-------+--------------------------------------------------------------------------
cassandra | True | True | {}
kalle_wl | False | False | {'AUDIT WHITELIST ON data/ks/test': 'ALTER,DROP,SELECT,MODIFY,AUTHORIZE'}
-> This could lead to whitelist "issues" if another table is created with the same name... The new table will immediately be whitelisted, which might not be the intent.
The text was updated successfully, but these errors were encountered:
When using Role Based Whitelisting with the following setup:
Given user/role kalle_wl wihch is granted all permissions to table ks.test:
cassandra@cqlsh> grant all on TABLE ks.test TO kalle_wl;
And the user/role is whitelisted for the ks.test table:
cassandra@cqlsh> ALTER ROLE kalle_wl WITH OPTIONS = { 'GRANT AUDIT WHITELIST FOR ALL' : 'data/ks/test' };
Gives the following permissions:
Gives the role options:
When the table is dropped:
cassandra@cqlsh> DROP TABLE ks.test ;
Then the permission for that table is removed:
BUT the whitelist-data for that user is not removed:
-> This could lead to whitelist "issues" if another table is created with the same name... The new table will immediately be whitelisted, which might not be the intent.
The text was updated successfully, but these errors were encountered: