[CASSANDRA-8650] Creation and maintenance of roles should not require superuser status

• Type: Sub-task
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 2.2.0 beta 1
• Component/s: Legacy/CQL, Legacy/Distributed Metadata
• Labels: cql security
• Assignee: Sam Tunnicliffe
• Reporter: Sam Tunnicliffe

Authors

Sam Tunnicliffe

Reviewers

Aleksey Yeschenko

• Tester: Philip Thompson
• Created: 20/Jan/15 16:04
• Updated: 16/Apr/19 09:31
• Resolved: 06/Feb/15 00:42

Description

Currently, only roles with superuser status are permitted to create/drop/grant/revoke roles, which violates the principal of least privilege. In addition, in order to run ALTER ROLE statements a user must log in directly as that role or else be a superuser. This requirement increases the (ab)use of superuser privileges, especially where roles are created without LOGIN privileges to model groups of permissions granted to individual db users. In this scenario, a superuser is always required if such roles are to be granted and modified.

We should add more granular permissions to allow administration of roles without requiring superuser status.

Issue Links

• is required by: CASSANDRA-7216 Creating database resources automatically grants creator full permissions