[DERBY-3333] User name corresponding to authentication identifier PUBLIC must be rejected

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 10.0.2.0, 10.0.2.1, 10.1.1.0, 10.1.2.1, 10.1.3.1, 10.2.1.6, 10.2.2.0, 10.3.1.4, 10.3.2.1, 10.4.1.3
• Component/s: SQL
• Labels: derby_triage10_5_2
• Urgency: Normal
• Issue & fix info: Release Note Needed
• Bug behavior facts: Security
• Assignee: Unassigned
• Reporter: Daniel John Debrunner
• Created: 18/Jan/08 20:11
• Updated: 15/Feb/11 21:08

Description

SQL Standard (foundation) says:

Section 5.4 SR 20) No <authorization identifier> shall specify "PUBLIC".

This is a syntax rule which implies a 42xxx SQL state but I wonder if 'invalid authorization specification.' (28xxx) makes more sense?
Maybe it's 28xxx when used in a connection request and 42xxx in a SQL statement?

Needs to be disallowed on:
JDBC connection requests
GRANT statements, ie. using "PUBLIC" as a delimited identifier.

Existing application impact if the exists a user with an authorization identifier of PUBLIC in an existing system.

Issue Links

• is related to: DERBY-2207 Improve usability of Derby's client/server security by implementing ANSI Roles