Jira (PDB-2842) PDB should grant read-only access to different [read-database] user

[Andrey Galkin (JIRA)]

Title: Message Title

Andrey Galkin created an issue   PuppetDB / PDB-2842 PDB should grant read-only access to different [read-database] user Issue Type: Bug Affects Versions: PDB 4.1.2 Assignee: Unassigned Created: 2016/06/24 2:37 PM Priority: Normal Reporter: Andrey Galkin SITUATION: 1. [read-database] has different PostgreSQL user than in [database] section 2. The read-only user is allowed to connect to DB, but fails to query objects created by read-write user 3. Example output: WARN [o.e.j.s.HttpChannel] /pdb/query/v4/facts?query=[%22extract%22,[%22certname%22,%22name%22,%22value%22],[%22and%22,[%22in%22,%22certname%22,[%22extract%22,%22certname%22,[%22select_resources%22,[%22and%22,[%22=%22,%22type%22,%22Class %22],[%22=%22,%22title%22,%22Cftotalcontrol%22],[%22=%22,%22exported%22,false]]]]],[%22or%22,[%22=%22,%22name%22,%22cf_totalcontrol_key%22],[%22=%22,%22name%22,%22cf_totalcontrol_scope_keys%22]]]] javax.servlet.ServletException: org.postgresql.util.PSQLException: ERROR: permission denied for relation factsets CURRENT WORKAROUND: Use the same read-write user even on read-only load-distributed instances PROPOSED SOLUTION: 1. PDB should try to grant read-only permissions to [read-database] user, if it mismatches user name from [database] section 2. PDB should ensure [read-database] user can query database objects on startup and fail early, if it is not so 3. Unless there is automatic permission management, a clear note should be present in documentation. Add Comment   This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.