Snowflake Database proper grants for Kafka connector role - snowflake-cloud-data-platform

I'm following the guide: Installing and Configuring the Kafka Connector
Snowflake Sink cannot be created with error: snowflake.database.name database does not exit
A bit of investigation and kafka_connector user cannot see the database from the showsql console:
kafka_connector_user_2#(no warehouse)#(no database).(no schema)>SHOW DATABASES like 'kafka%';
+------------+------+------------+------------+--------+-------+---------+---------+----------------+
| created_on | name | is_default | is_current | origin | owner | comment | options | retention_time |
|------------+------+------------+------------+--------+-------+---------+---------+----------------|
+------------+------+------------+------------+--------+-------+---------+---------+----------------+
0 Row(s) produced.
From sysadmin account:
Database
SHOW DATABASES like 'kafka%';
+-------------------------------+----------+------------+------------+--------+----------+---------+---------+----------------+
| created_on | name | is_default | is_current | origin | owner | comment | options | retention_time |
|-------------------------------+----------+------------+------------+--------+----------+---------+---------+----------------|
| 2020-06-24 05:02:47.370 -0700 | KAFKA_DB | N | N | | SYSADMIN | | | 1 |
+-------------------------------+----------+------------+------------+--------+----------+---------+---------+----------------+
DB grants:
>SHOW GRANTS on database KAFKA_DB;
+-------------------------------+-----------------+------------+----------+------------+------------------------+--------------+------------+
| created_on | privilege | granted_on | name | granted_to | grantee_name | grant_option | granted_by |
|-------------------------------+-----------------+------------+----------+------------+------------------------+--------------+------------|
| 2020-06-26 01:11:22.082 -0700 | CREATE SCHEMA | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | MODIFY | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | MONITOR | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | REFERENCE_USAGE | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | USAGE | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-24 05:02:47.167 -0700 | OWNERSHIP | DATABASE | KAFKA_DB | ROLE | SYSADMIN | true | SYSADMIN |
+-------------------------------+-----------------+------------+----------+------------+------------------------+--------------+------------+
Role - User:
>SHOW GRANTS to user KAFKA_CONNECTOR_USER_2;
+-------------------------------+------------------------+------------+------------------------+---------------+
| created_on | role | granted_to | grantee_name | granted_by |
|-------------------------------+------------------------+------------+------------------------+---------------|
| 2020-06-26 01:04:59.699 -0700 | KAFKA_CONNECTOR_ROLE_1 | USER | KAFKA_CONNECTOR_USER_2 | SECURITYADMIN |
+-------------------------------+------------------------+------------+------------------------+---------------+
Role grants:
SHOW GRANTS to role KAFKA_CONNECTOR_ROLE_1;
+-------------------------------+--------------------------+------------+-----------------------+------------+------------------------+--------------+------------+
| created_on | privilege | granted_on | name | granted_to | grantee_name | grant_option | granted_by |
|-------------------------------+--------------------------+------------+-----------------------+------------+------------------------+--------------+------------|
| 2020-06-26 01:11:22.082 -0700 | CREATE SCHEMA | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | MODIFY | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | MONITOR | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | REFERENCE_USAGE | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:11:22.082 -0700 | USAGE | DATABASE | KAFKA_DB | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-25 10:49:19.359 -0700 | CREATE PIPE | SCHEMA | KAFKA_DB.KAFKA_SCHEMA | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-25 10:49:18.358 -0700 | CREATE STAGE | SCHEMA | KAFKA_DB.KAFKA_SCHEMA | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-25 10:49:16.356 -0700 | CREATE TABLE | SCHEMA | KAFKA_DB.KAFKA_SCHEMA | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-25 10:49:14.354 -0700 | USAGE | SCHEMA | KAFKA_DB.KAFKA_SCHEMA | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
| 2020-06-26 01:16:36.396 -0700 | OPERATE | WAREHOUSE | COMPUTE_WH | ROLE | KAFKA_CONNECTOR_ROLE_1 | false | SYSADMIN |
+-------------------------------+--------------------------+------------+-----------------------+------------+------------------------+--------------+------------+
What am I missing ?

It looks like your "context" isn't set for that session, where context includes "current":
role
warehouse
database and schema
I'd recommend reviewing your connection properties, as well as executing the following and trying again:
ALTER USER kafka_connector_user_2 SET DEFAULT_ROLE = 'KAFKA_CONNECTOR_ROLE_1';
ALTER USER kafka_connector_user_2 SET DEFAULT_WAREHOUSE = 'COMPUTE_WH' ;
ALTER USER kafka_connector_user_2 SET DEFAULT_NAMESPACE = 'KAFKA_DB.KAFKA_SCHEMA' ;
https://docs.snowflake.com/en/sql-reference/sql/alter-user.html
Setting the user's default context is something I recommend for all "programatic" users (a.k.a. "Service Accounts").
I hope this helps...Rich

Related

snowflake show Roles does not show the user name

Show ROLES provide me the info about Roles and user to whom the roles are assigned to.
However instead of providing the username it gives the user number like below in assigned_to_users
show roles;
---------------------------------+---------------+------------+------------+--------------+-------------------+------------------+---------------+---------------+--------------------------+
created_on | name | is_default | is_current | is_inherited | assigned_to_users | granted_to_roles | granted_roles | owner | comment |
---------------------------------+---------------+------------+------------+--------------+-------------------+------------------+---------------+---------------+--------------------------+
Fri, 05 Dec 2014 16:25:06 -0800 | ACCOUNTADMIN | Y | Y | N | 1 | 0 | 2 | | |
Mon, 15 Dec 2014 17:58:33 -0800 | ANALYST | N | N | N | 0 | 6 | 0 | SECURITYADMIN | Data analyst |
Fri, 05 Dec 2014 16:25:06 -0800 | PUBLIC | N | N | Y | 0 | 0 | 0 | | |
Fri, 05 Dec 2014 16:25:06 -0800 | SECURITYADMIN | N | N | Y | 0 | 1 | 0 | | |
Fri, 05 Dec 2014 16:25:06 -0800 | SYSADMIN | N | N | Y | 5 | 1 | 2 | | |
---------------------------------+---------------+------------+------------+--------------+-------------------+------------------+---------------+---------------+--------------------------+
is there a way I can join the number to actual user.
SHOW USERS is show you the count of users it is assigned to:
SHOW USERS;
created_on
name
is_default
is_current
is_inherited
assigned_to_users
granted_to_roles
granted_roles
2022-03-06
USERADMIN
N
N
Y
0
1
0
create user testo;
grant role useradmin to user testo;
SHOW USERS;
created_on
name
is_default
is_current
is_inherited
assigned_to_users
granted_to_roles
granted_roles
2022-03-06
USERADMIN
N
N
Y
1
1
0
You might want the SHOW GRANTS command, in the show grants of role <role_name>; form? But that will require multiple requests to see all GRANTS of ALL roles to all users.
OR on a per database level information_schema.APPLICABLE_ROLES:
SELECT * FROM information_schema.APPLICABLE_ROLES;
GRANTEE
ROLE_NAME
ROLE_OWNER
IS_GRANTABLE
SIMEON
ACCOUNTADMIN
NO
SIMEON
ORGADMIN
NO
SIMEON
PUBLIC
NO
ACCOUNTADMIN
SECURITYADMIN
NO
ACCOUNTADMIN
SYSADMIN
NO
SECURITYADMIN
USERADMIN
NO
GRANTS_TO_ROLES View holds the privileges granted to roles.
GRANTS_TO_USERS View holds the roles granted to the users.
You can join them as follows to get what you're looking for:
select u.grantee_name
, u.role
, r.privilege
, r.granted_on
, r.name
from snowflake.account_usage.grants_to_users u
join snowflake.account_usage.grants_to_roles r
on u.role = r.grantee_name
where u.grantee_name = '<user_name>'
order by 1,2,3,4,5;

EF Core database connection kept active

I have an .Net Core application using EF Core with postgres. While the application is running, IF I run
docker exec -i postgres-db psql -U admin eventsDb --command "select pid as process_id, usename as username, datname as database_name, client_addr as client_address, application_name, backend_start, state, state_changefrom pg_stat_activity";
There are 7 processes running:
pid | username | database_name | client_address | application_name | backend_start | state | state_change
-----+----------+---------------+----------------+------------------+-------------------------------+--------+-------------------------------
33 | | | | | 2021-04-15 14:10:43.496459+00 | |
35 | admin | | | | 2021-04-15 14:10:43.497432+00 | |
232 | admin | eventsDb | 172.18.0.1 | | 2021-04-15 14:27:21.61369+00 | idle | 2021-04-15 14:27:21.675184+00
246 | admin | eventsDb | | psql | 2021-04-15 14:27:38.210868+00 | active | 2021-04-15 14:27:38.216957+00
31 | | | | | 2021-04-15 14:10:43.495634+00 | |
30 | | | | | 2021-04-15 14:10:43.494741+00 | |
32 | | | | | 2021-04-15 14:10:43.496089+00 | |
(7 rows)
If I stop the application has 6 processes:
$ docker exec -i postgres-db psql -U admin eventsDb --command "select pid, usename as username, datname as database_name, client_addr as client_address, application_name, backend_start, state, state_change from pg_stat_activity";
pid | username | database_name | client_address | application_name | backend_start | state | state_change
-----+----------+---------------+----------------+------------------+-------------------------------+--------+-------------------------------
33 | | | | | 2021-04-15 14:10:43.496459+00 | |
35 | admin | | | | 2021-04-15 14:10:43.497432+00 | |
261 | admin | eventsDb | | psql | 2021-04-15 14:28:10.544338+00 | active | 2021-04-15 14:28:10.546737+00
31 | | | | | 2021-04-15 14:10:43.495634+00 | |
30 | | | | | 2021-04-15 14:10:43.494741+00 | |
32 | | | | | 2021-04-15 14:10:43.496089+00 | |
(6 rows)
The connection string is:
"Host=localhost;Username=admin;Password=<password>;Database=eventsDb;"
The question is:
Is this the normal behavior for EF Core when no database IO operation performed?

Netezza SQL to find Client IP

Is there any way to return the client IP address in Netezza? In Oracle we run below query .
SELECT SYS_CONTEXT('USERENV','IP_ADDRESS') FROM dual;
Thanks
This query can get you all the information you need about the current_session.
select client_ip
from _v_session_detail
where session_id= CURRENT_SID
You can use "show session" to provide that information if you aren't trying to access it as a column in a table.
SYSTEM.ADMIN(ADMIN)=> SYSTEM.ADMIN(ADMIN)=> show session;
SESSION_ID | PID | USERNAME | DBNAME | SCHEMA | TYPE | CONNECT_TIME | SESSION_STATE_NAME | SQLTEXT | PRIORITY_NAME | CLIENT_PID | CLIENT_IP | CLIENT_OS_USERNAME
------------+-------+----------+--------+--------+------+---------------------+--------------------+--------------+---------------+------------+-----------+--------------------
16228 | 10272 | ADMIN | SYSTEM | ADMIN | sql | 2014-12-10 10:56:48 | active | show session | normal | 10271 | 127.0.0.1 |
(1 row)
You can also query against the _v_session, which will report on sessions you have visibility/authorization to see, but doesn't necessarily tell you which one is yours. For a non-administrative user this is usually only your sessions, so it should be easy to tell.
SYSTEM.ADMIN(ADMIN)=> select * from _v_session;
ID | PID | USERNAME | DBNAME | TYPE | CONNTIME | STATUS | COMMAND | PRIORITY | CID | IPADDR | CLIENT_OS_USERNAME
-------+-------+----------+--------+------+---------------------+--------+--------------------------+----------+-------+-----------+--------------------
16228 | 10272 | ADMIN | SYSTEM | sql | 2014-12-10 10:56:48 | active | select * from _v_session | 3 | 10271 | 127.0.0.1 |
(1 row)
If you want information only about the particular session in which you are calling the query, then this will do the trick.
SYSTEM.ADMIN(ADMIN)=> select * from _v_session where id = current_sid;
ID | PID | USERNAME | DBNAME | TYPE | CONNTIME | STATUS | COMMAND | PRIORITY | CID | IPADDR | CLIENT_OS_USERNAME
-------+-------+----------+--------+------+---------------------+--------+-------------------------------------------------+----------+-------+-----------+--------------------
16837 | 22310 | ADMIN | SYSTEM | sql | 2014-12-10 19:06:21 | active | select * from _v_session where id = current_sid | 3 | 22309 | 127.0.0.1 |
(1 row)
I should note that what you're looking for here is already being tracked by the query history database, which is most likely already configured on your system.

Grails add domain field as database index

I'm using grails 1.2.2 and 1.3.7 in my project.
I want to add an index to the domain's table.
class Test {
String name
String surname
static mapping = {
name column: 'name', index: 'test_dx'
surname column: 'surname', index: 'test_dx'
}
}
I tried with the two version of grails and with dbCreate = "create" or dbCreate = "create-drop" or dbCreate = "update" (is the one I want to use) but no "custom index" created.
Your example works for me. If I run my app in update mode with a MySQL database, then I get this from the MySQL console:
mysql> show index from test;
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+
| Table | Non_unique | Key_name | Seq_in_index | Column_name | Collation | Cardinality | Sub_part | Packed | Null | Index_type | Comment |
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+
| test | 0 | PRIMARY | 1 | id | A | 0 | NULL | NULL | | BTREE | |
| test | 1 | test_dx | 1 | name | A | 0 | NULL | NULL | | BTREE | |
| test | 1 | test_dx | 2 | surname | A | 0 | NULL | NULL | | BTREE | |
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+
3 rows in set (0.00 sec)
What database are you using?

Where is Drupal Organic Group Role Data stored? How do I access it?

I've created a custom Role for my Group.
I've assigned a user, who was a member of the Group, to this special Role.
Now, I want to access a user's Role in the Group via PHP, but I can't find it anywhere.
I've pored over the Devels of both the User and Group. I can access the fact that the user is a member of the group in the user's group_audience array, but not what their role is in that group.
Any advice?
Edit: Drupal 7
Edit: There's some background here first, then the actual answer is after that.
Background
Looking in the mySQL database on our development server, there seems to be a handful of OG-related tables in our Drupal database. I'm pretty sure the version running on the devserver is og-7.x-1.x-dev.
og
og_membership
og_membership_type
og_menu
og_role
og_role_permission
og_users_roles
field_data_og_membership_request
field_revision_og_membership_request
Their definitions look like this:
mysql> describe og;
+-------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+-------------+------------------+------+-----+---------+----------------+
| gid | int(10) unsigned | NO | PRI | NULL | auto_increment |
| etid | int(10) unsigned | NO | MUL | 0 | |
| entity_type | varchar(32) | NO | | | |
| label | varchar(255) | NO | | | |
| state | int(11) | NO | | 1 | |
| created | int(11) | NO | | 0 | |
+-------------+------------------+------+-----+---------+----------------+
6 rows in set (0.02 sec)
mysql> describe og_membership;
+-------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+-------------+------------------+------+-----+---------+----------------+
| id | int(10) unsigned | NO | PRI | NULL | auto_increment |
| type | varchar(255) | NO | | | |
| etid | int(10) unsigned | NO | MUL | 0 | |
| entity_type | varchar(32) | NO | | | |
| gid | int(11) | NO | MUL | NULL | |
| state | varchar(255) | YES | | | |
| created | int(11) | NO | | 0 | |
+-------------+------------------+------+-----+---------+----------------+
7 rows in set (0.00 sec)
mysql> describe og_membership_type;
+-------------+--------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+-------------+--------------+------+-----+---------+----------------+
| id | int(11) | NO | PRI | NULL | auto_increment |
| name | varchar(255) | NO | UNI | | |
| description | varchar(255) | NO | | | |
| status | tinyint(4) | NO | | 1 | |
| module | varchar(255) | YES | | NULL | |
+-------------+--------------+------+-----+---------+----------------+
5 rows in set (0.00 sec)
mysql> describe og_menu;
+-----------+--------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-----------+--------------+------+-----+---------+-------+
| gid | int(11) | NO | PRI | NULL | |
| menu_name | varchar(128) | NO | PRI | | |
+-----------+--------------+------+-----+---------+-------+
2 rows in set (0.00 sec)
mysql> describe og_role;
+-------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+-------+------------------+------+-----+---------+----------------+
| rid | int(10) unsigned | NO | PRI | NULL | auto_increment |
| gid | int(11) | NO | | NULL | |
| name | varchar(64) | NO | | | |
+-------+------------------+------+-----+---------+----------------+
3 rows in set (0.00 sec)
mysql> describe og_role_permission;
+------------+------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+------------+------------------+------+-----+---------+-------+
| rid | int(10) unsigned | NO | PRI | NULL | |
| permission | varchar(64) | NO | PRI | | |
| module | varchar(255) | NO | | | |
+------------+------------------+------+-----+---------+-------+
3 rows in set (0.00 sec)
mysql> describe og_users_roles;
+-------+------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-------+------------------+------+-----+---------+-------+
| uid | int(10) unsigned | NO | PRI | 0 | |
| rid | int(10) unsigned | NO | PRI | 0 | |
| gid | int(11) | NO | PRI | NULL | |
+-------+------------------+------+-----+---------+-------+
3 rows in set (0.00 sec)
mysql> describe field_data_og_membership_request;
+------------------------------+------------------+------+-----+---------+
| Field | Type | Null | Key | Default |
+------------------------------+------------------+------+-----+---------+
| entity_type | varchar(128) | NO | PRI | |
| bundle | varchar(128) | NO | MUL | |
| deleted | tinyint(4) | NO | PRI | 0 |
| entity_id | int(10) unsigned | NO | PRI | NULL |
| revision_id | int(10) unsigned | YES | MUL | NULL |
| language | varchar(32) | NO | PRI | |
| delta | int(10) unsigned | NO | PRI | NULL |
| og_membership_request_value | longtext | YES | | NULL |
| og_membership_request_format | varchar(255) | YES | MUL | NULL |
+------------------------------+------------------+------+-----+---------+
9 rows in set (0.00 sec)
mysql> describe field_revision_og_membership_request;
+------------------------------+------------------+------+-----+---------+
| Field | Type | Null | Key | Default |
+------------------------------+------------------+------+-----+---------+
| entity_type | varchar(128) | NO | PRI | |
| bundle | varchar(128) | NO | MUL | |
| deleted | tinyint(4) | NO | PRI | 0 |
| entity_id | int(10) unsigned | NO | PRI | NULL |
| revision_id | int(10) unsigned | NO | PRI | NULL |
| language | varchar(32) | NO | PRI | |
| delta | int(10) unsigned | NO | PRI | NULL |
| og_membership_request_value | longtext | YES | | NULL |
| og_membership_request_format | varchar(255) | YES | MUL | NULL |
+------------------------------+------------------+------+-----+---------+
9 rows in set (0.00 sec)
(I've removed the empty Extras column from the two field_* tables to avoid horizontal scrolling.) Hope that helps?
My workings
Having just had to mess with this myself on my own Drupal site, it turns out that og_membership has a row for each user in each group (I've abbreviated the type, which read og_membership_type_default):
mysql> select * from og_membership where gid = 324 and etid = 182905;
+--------+-----------------+--------+-------------+-----+-------+------------+
| id | type | etid | entity_type | gid | state | created |
+--------+-----------------+--------+-------------+-----+-------+------------+
| 223562 | og_m..._default | 182905 | user | 324 | 1 | 1329388409 |
+--------+-----------------+--------+-------------+-----+-------+------------+
1 row in set (0.01 sec)
In this row, the id is an autoincrementing identifier for the table og_membership, the etid corresponds to the users.uid for the user in question and gid corresponds to to the og.gid for the group in question.
So if I run the query
update og_membership set gid = 38 where gid = 324;
then all the members of group #324 are moved to group #38 (which is what I've just needed to do, due to an error in an import script).
I think the answer to your question is that the og_membership.type corresponds to an og_membership_type.name. Looking at that table:
mysql> select * from og_membership_type;
+----+----------------------------+-------------+--------+--------+
| id | name | description | status | module |
+----+----------------------------+-------------+--------+--------+
| 1 | og_membership_type_default | Default | 2 | og |
+----+----------------------------+-------------+--------+--------+
1 row in set (0.00 sec)
, I think the og_membership_type.status corresponds to the og_role.rid:
mysql> select * from og_role;
+-----+-----+----------------------+
| rid | gid | name |
+-----+-----+----------------------+
| 1 | 0 | non-member |
| 2 | 0 | member |
| 3 | 0 | administrator member |
+-----+-----+----------------------+
3 rows in set (0.00 sec)
Actual answer
So I think the query you want is:
select og_role.name
from og_role
inner join og_membership_type on og_role.rid = og_membership_type.status
inner join og_membership on og_membership_type.name = og_membership.type
where og_membership.gid = $group_id;
where $group_id is the og.gid of the group in question. (The ID that appears in the URL is the og.etid, so you might want to add another join to that query.

Resources