Grant mismatch between worker and server

[ozansz]

Bug Report

Briefly describe the bug

We have observed that when we run a query inside a virtual warehouse worker directly using a user created in the server, the VW worker sometimes recognizes the user grants but sometimes not. There is no grant issue when we run the same query in the server, but it fails nondeterministically (as far as we understood) inside the virtual warehouse worker.

The result you expected

We expected when the same query is run in both server and virtual warehouse worker directly, both to recognize the grants given to the specific user, as both worker and server should use FDB for user grants.

How to Reproduce

Run a query which requires explicit grants which are already given to a specific user, in both VW worker and server. Or, query the grants of that specific user:

1. Create a user with name support and grant for example a role named read_all

2. Inside VW:

show grants for support

GRANT NONE TO support

3. Inside server:

show grants for support

GRANT read_all TO support

4. After some trials in VW, we also see the same correct result as in server:

show grants for support

GRANT read_all TO support

Version

cc4e467

[nudles]

@ozansz thanks for reporting the issue.
After step 4, does the VW worker always return the correct results?
Does it return Grant NONE TO support again?

[ozansz]

@nudles After step 4, the VW worker always returns the correct results, yes. Might it be because of some caching mechanism?

[nudles]

@ozansz , currently we do not support the auto sync of the RBAC information to workers.
RBAC is auto synced among servers only.
Hope it clarifies.