Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-45067

Different RBAC behavior between FTS backup/restore endpoints between 6.x.x and 7.0.0

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Critical
    • 7.0.0
    • Cheshire-Cat
    • fts
    • None
    • Untriaged
    • 1
    • Unknown

    Description

      What's the issue?
      The available FTS endpoints which are used by 'cbbackupmgr' (depending on the cluster version) currently behave differently when using the 'Data Backup & Restore [*]' RBAC role.

      A user with the 'Data Backup & Restore [*]' role is able to backup FTS aliases on a 6.x.x cluster whereas they are not on 7.0.0. Ideally these endpoints should exhibit the same behavior in this regard.

      I've attached logs for 6.6.1 and 7.0.0 which displays this difference in behavior; both are using the same version of 'cbbackupmgr'. We see that the backup against 6.6.1 completes successfully, however, 7.0.0 fails with the following message:

      Error backing up cluster: {"message":"Forbidden. User needs one of the following permissions","permissions":["cluster.fts!read"]}
      

      Note that against the 6.6.1 cluster 'cbbackupmgr' is hitting the endpoint '/api/index' and against a 7.0.0 cluster 'cbbackpumgr' it's hitting the '/api/v1/backup' endpoint.

      Please see MB-44965 for more information.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              evgeny.makarenko Evgeny Makarenko (Inactive)
              james.lee James Lee
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes

                  PagerDuty