Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DB auto-user provisioning to support db_user_options #48898

Open
greedy52 opened this issue Nov 13, 2024 · 1 comment
Open

DB auto-user provisioning to support db_user_options #48898

greedy52 opened this issue Nov 13, 2024 · 1 comment
Labels
database-access Database access related issues and PRs feature-request Used for new features in Teleport, improvements to current should be #enhancements

Comments

@greedy52
Copy link
Contributor

greedy52 commented Nov 13, 2024

What would you like Teleport to do?
https://goteleport.com/docs/enroll-resources/database-access/auto-user-provisioning/postgres/

spec:
  options:
    create_db_user_mode: best_effort_drop
  allow:
    db_roles:
    - rds_superuser
+   db_user_options:
+   - CREATEDB

What problem does this solve?

Allow auto-provisioned users to have role options like SUPERUSER, CREATEDB, REPLICATION, etc.

(Though we have to think through the consequences when the auto-provisioned users have some of these high privileges.)

If a workaround exists, please include it.

Use keep mode, and login the database as an admin then manually grant the auto-provisioned user these options.

@greedy52 greedy52 added database-access Database access related issues and PRs feature-request Used for new features in Teleport, improvements to current should be #enhancements labels Nov 13, 2024
@GavinFrazar
Copy link
Contributor

another use case might be setting NOINHERIT so that a user must SET ROLE <role> to use a role they were granted, i.e role assumption in postgres

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
database-access Database access related issues and PRs feature-request Used for new features in Teleport, improvements to current should be #enhancements
Projects
None yet
Development

No branches or pull requests

2 participants