security: add mode to restrict local user administration to admins #14494

ijon · 2025-02-12T13:42:18Z

Feature flag enable_strict_user_management restricts administration of local users and groups to subjects with administration access level. Administration access level belongs to cluster admins (members of the administration_allowed_sids) and also, if enabled, to database admins (owners of a database).

Feature flag enable_database_admin enables database admins as a concept.

Also admin are now allowed to change schema objects ownership.

Stacked on:

security: unify and extend admin checks #14489

There will be follow-ups.

Changelog category

Not for changelog

github-actions · 2025-02-12T18:54:21Z

⚪ 2025-02-12 18:54:20 UTC Pre-commit check linux-x86_64-relwithdebinfo for 6c1f64b has started.
⚪ 2025-02-12 18:54:45 UTC Artifacts will be uploaded here
⚪ 2025-02-12 18:58:23 UTC ya make is running...
🟡 2025-02-12 20:00:26 UTC Some tests failed, follow the links below. Going to retry failed tests...

Test history | Ya make output | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
27947	25357	0	4	2455	131

⚪ 2025-02-12 20:03:08 UTC ya make is running... (failed tests rerun, try 2)
🟡 2025-02-12 20:23:32 UTC Some tests failed, follow the links below. Going to retry failed tests...

Test history | Ya make output | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
204 (only retried tests)	77	0	1	1	125

⚪ 2025-02-12 20:23:41 UTC ya make is running... (failed tests rerun, try 3)
🟢 2025-02-12 20:35:27 UTC Tests successful.

Test history | Ya make output | Test bloat | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
185 (only retried tests)	60	0	0	1	124

🟢 2025-02-12 20:35:34 UTC Build successful.
🟢 2025-02-12 20:35:57 UTC ydbd size 2.1 GiB changed* by +62.7 KiB, which is < 100.0 KiB vs main: OK

ydbd size dash	main: `5876eb7`	merge: `6c1f64b`	diff	diff %
ydbd size	2 229 245 008 Bytes	2 229 309 216 Bytes	+62.7 KiB	+0.003%
ydbd stripped size	473 342 968 Bytes	473 357 048 Bytes	+13.8 KiB	+0.003%

^{*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation}

github-actions · 2025-02-12T18:57:13Z

⚪ 2025-02-12 18:57:12 UTC Pre-commit check linux-x86_64-release-asan for 6c1f64b has started.
⚪ 2025-02-12 18:57:27 UTC Artifacts will be uploaded here
⚪ 2025-02-12 19:00:35 UTC ya make is running...
🟡 2025-02-12 19:59:49 UTC Some tests failed, follow the links below. This fail is not in blocking policy yet Going to retry failed tests...

Test history | Ya make output | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
13706	13626	0	28	13	39

⚪ 2025-02-12 20:01:02 UTC ya make is running... (failed tests rerun, try 2)
🟡 2025-02-12 20:19:05 UTC Some tests failed, follow the links below. This fail is not in blocking policy yet Going to retry failed tests...

Test history | Ya make output | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
121 (only retried tests)	81	0	2	4	34

⚪ 2025-02-12 20:19:14 UTC ya make is running... (failed tests rerun, try 3)
🟡 2025-02-12 20:37:50 UTC Some tests failed, follow the links below. This fail is not in blocking policy yet

Test history | Ya make output | Test bloat | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
71 (only retried tests)	35	0	1	2	33

🟢 2025-02-12 20:37:58 UTC Build successful.
🟡 2025-02-12 20:38:26 UTC ydbd size 3.6 GiB changed* by +125.2 KiB, which is >= 100.0 KiB vs main: Warning

ydbd size dash	main: `5876eb7`	merge: `6c1f64b`	diff	diff %
ydbd size	3 876 525 608 Bytes	3 876 653 768 Bytes	+125.2 KiB	+0.003%
ydbd stripped size	1 357 556 192 Bytes	1 357 597 536 Bytes	+40.4 KiB	+0.003%

^{*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation}

…dmins

…abaseName

github-actions · 2025-02-13T09:54:40Z

⚪ 2025-02-13 09:54:40 UTC Pre-commit check linux-x86_64-relwithdebinfo for 17cbf51 has started.
⚪ 2025-02-13 09:54:51 UTC Artifacts will be uploaded here
⚪ 2025-02-13 09:58:02 UTC ya make is running...
🟡 2025-02-13 11:22:58 UTC Some tests failed, follow the links below. Going to retry failed tests...

Test history | Ya make output | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
27952	25358	0	2	2459	133

⚪ 2025-02-13 11:25:38 UTC ya make is running... (failed tests rerun, try 2)
🟡 2025-02-13 11:50:08 UTC Some tests failed, follow the links below. Going to retry failed tests...

Test history | Ya make output | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
209 (only retried tests)	82	0	1	0	126

⚪ 2025-02-13 11:50:16 UTC ya make is running... (failed tests rerun, try 3)
🟢 2025-02-13 12:09:48 UTC Tests successful.

Test history | Ya make output | Test bloat | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
186 (only retried tests)	62	0	0	0	124

🟢 2025-02-13 12:09:55 UTC Build successful.
🟢 2025-02-13 12:10:17 UTC ydbd size 2.1 GiB changed* by +58.5 KiB, which is < 100.0 KiB vs main: OK

ydbd size dash	main: `749f7cd`	merge: `17cbf51`	diff	diff %
ydbd size	2 230 113 376 Bytes	2 230 173 272 Bytes	+58.5 KiB	+0.003%
ydbd stripped size	473 416 696 Bytes	473 430 840 Bytes	+13.8 KiB	+0.003%

^{*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation}

github-actions · 2025-02-13T09:54:43Z

⚪ 2025-02-13 09:54:43 UTC Pre-commit check linux-x86_64-release-asan for 17cbf51 has started.
⚪ 2025-02-13 09:54:54 UTC Artifacts will be uploaded here
⚪ 2025-02-13 09:58:08 UTC ya make is running...
🟡 2025-02-13 11:41:58 UTC Some tests failed, follow the links below. This fail is not in blocking policy yet Going to retry failed tests...

Test history | Ya make output | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
13752	13646	0	53	17	36

⚪ 2025-02-13 11:43:13 UTC ya make is running... (failed tests rerun, try 2)
🟡 2025-02-13 11:55:40 UTC Some tests failed, follow the links below. This fail is not in blocking policy yet Going to retry failed tests...

Test history | Ya make output | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
155 (only retried tests)	109	0	6	8	32

⚪ 2025-02-13 11:55:49 UTC ya make is running... (failed tests rerun, try 3)
🟡 2025-02-13 12:07:47 UTC Some tests failed, follow the links below. This fail is not in blocking policy yet

Test history | Ya make output | Test bloat | Test bloat | Test bloat

TESTS	PASSED	ERRORS	FAILED	SKIPPED	MUTED^?
80 (only retried tests)	41	0	4	1	34

🟢 2025-02-13 12:07:54 UTC Build successful.
🟡 2025-02-13 12:08:22 UTC ydbd size 3.6 GiB changed* by +111.6 KiB, which is >= 100.0 KiB vs main: Warning

ydbd size dash	main: `749f7cd`	merge: `17cbf51`	diff	diff %
ydbd size	3 878 463 792 Bytes	3 878 578 040 Bytes	+111.6 KiB	+0.003%
ydbd stripped size	1 358 247 648 Bytes	1 358 281 760 Bytes	+33.3 KiB	+0.003%

^{*please be aware that the difference is based on comparing your commit and the last completed build from the post-commit, check comparation}

nikvas0

kqp ok

…db-platform#14494) Feature flag `enable_strict_user_management` restricts administration of local users and groups to subjects with administration access level. Administration access level belongs to cluster admins (members of the `administration_allowed_sids`) and also, if enabled, to database admins (owners of a database). Feature flag `enable_database_admin` enables database admins as a concept. Also allow admins to change ownership of the schema objects.

…14494) Feature flag `enable_strict_user_management` restricts administration of local users and groups to subjects with administration access level. Administration access level belongs to cluster admins (members of the `administration_allowed_sids`) and also, if enabled, to database admins (owners of a database). Feature flag `enable_database_admin` enables database admins as a concept. Also allow admins to change ownership of the schema objects.

github-actions bot added the not-for-changelog label Feb 12, 2025

ijon force-pushed the add-database-admin-concept branch from c74cf2e to 7e86ea9 Compare February 12, 2025 16:54

ydb-platform deleted a comment from github-actions bot Feb 12, 2025

ijon marked this pull request as ready for review February 12, 2025 20:42

ijon requested review from a team as code owners February 12, 2025 20:42

github-actions bot added not-for-changelog and removed not-for-changelog labels Feb 13, 2025

ijon added 4 commits February 13, 2025 12:01

tx-proxy: clarify names in code to better convey the meaning

5f530e1

tx-proxy: add mode to limit administration of local users/groups to a…

c220fb1

…dmins

fix sending TEvTxUserProxy::TEvProposeTransaction without setting Dat…

b3960ed

…abaseName

tx_proxy: add tests for admin restrictions

00940af

ijon force-pushed the add-database-admin-concept branch from ed332cb to 00940af Compare February 13, 2025 09:49

nikvas0 approved these changes Feb 13, 2025

View reviewed changes

CyberROFL approved these changes Feb 13, 2025

View reviewed changes

ijon merged commit 47bf59d into ydb-platform:main Feb 13, 2025
12 checks passed

ijon deleted the add-database-admin-concept branch February 13, 2025 12:52

GrigoriyPA mentioned this pull request Feb 13, 2025

YQ-3561 FQrun supported connections / bindings #14552

Merged

This was referenced Feb 15, 2025

YQ-4114 fixed pragmas for CTAS #14604

Merged

YQ remove anonymous namespace from CA #14636

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

security: add mode to restrict local user administration to admins #14494

security: add mode to restrict local user administration to admins #14494

Uh oh!

ijon commented Feb 12, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Feb 12, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Feb 12, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Feb 13, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Feb 13, 2025 •

edited

Loading

Uh oh!

nikvas0 left a comment

Uh oh!

Uh oh!

Uh oh!

security: add mode to restrict local user administration to admins #14494

security: add mode to restrict local user administration to admins #14494

Uh oh!

Conversation

ijon commented Feb 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog category

Uh oh!

github-actions bot commented Feb 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nikvas0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ijon commented Feb 12, 2025 •

edited

Loading

github-actions bot commented Feb 12, 2025 •

edited

Loading

github-actions bot commented Feb 12, 2025 •

edited

Loading

github-actions bot commented Feb 13, 2025 •

edited

Loading

github-actions bot commented Feb 13, 2025 •

edited

Loading