Database Automatic User Provisioning support for Redshift

[greedy52]

Part of:

• Extend auto user provisioning to support more databases #27323

Related:

• Add support for automatic database users for Postgres #25614

Summary

• The overall logic of the stored procedures for Redshift follows the same logic as Postgres.
• Different tables/views are used for Redshift.
• Some syntax differences for Redshift
  • Redshift has no array so have to use JSON text
  • Slightly different syntax for execute
  • Have to raise exception to generate errors
• Used connection limit to lock/unlock the account (client sees FATAL: too many connections for user "STeve" if attempt to login)
• Added logic to detect User has active connections and roles have changed

Manual testing setup example

1. Configure Redshift

Login in as a superuser, create teleport-admin:

CREATE USER "teleport-admin" WITH PASSWORD DISABLE;
GRANT ROLE "sys:superuser" TO "teleport-admin";

Generate a few roles for testing:

CREATE ROLE role1;
CREATE ROLE role2;
CREATE ROLE role3;
GRANT ALL ON DATABASE test TO ROLE "role1";

2. Configure Teleport

Create a Teleport role for auto-user and assign it to your Teleport user, ex:

kind: role
version: v6
metadata:
  name: redshift-auto-user
spec:
  options:
    create_db_user: true
  allow:
    db_labels:
      "Owner": "STeve"
      "teleport.dev/db-admin": "teleport-admin"
    db_names:
    - "*"
    db_roles:
    - "role1"
    - "role3"

Use auto-discovery to register the Redshift database. Make sure teleport.dev/db-admin resource tag is set to teleport-admin.

3. Connect

• tsh login
• tsh db connect --db-user <teleport-user> --db-name test steve-redshift
• select * from svv_user_grants

[Tener]

Sorry, I missed this one; uppercase scripts were a pure nit, so my intent was to approve prior to this change.

[smallinsky]

nit: can me move the sql scripts to a separate directory postgres/assets? ( not necessary in this PR)

[Tener]

I planned to suggest the same, except I had postgres/sql in mind.

[smallinsky]

I got following error from teleport_activate_user procedure call in fresh redshift setup during testing:

tsh db connect --db-user=marek --db-name=dev marek-redshift-cluster-1
psql: error: connection to server at "localhost" (::1), port 54170 failed: Connection refused
	Is the server running on that host and accepting TCP/IP connections?
connection to server at "localhost" (127.0.0.1), port 54170 failed: your Teleport role requires automatic database user provisioning but an attempt to activate database user "marek" failed due to the following error: ERROR: user "marek" does not exist (SQLSTATE 42704)

Also when I tries to call teleport_activate_user manually:

dev=# select * from pg_user;
    usename     | usesysid | usecreatedb | usesuper | usecatupd |  passwd  | valuntil | useconfig
----------------+----------+-------------+----------+-----------+----------+----------+-----------
 rdsdb          |        1 | t           | t        | t         | ******** | infinity |
 admin          |      100 | t           | t        | f         | ******** |          |
 teleport-admin |      101 | f           | f        | f         | ******** |          |

dev=# select * from SVV_ROLES;
 role_id |     role_name      |   role_owner   | external_id
---------+--------------------+----------------+-------------
  105587 | sys:operator       | rdsdb          |
  105588 | sys:monitor        | rdsdb          |
  105589 | sys:dba            | rdsdb          |
  105590 | sys:secadmin       | rdsdb          |
  105591 | sys:superuser      | rdsdb          |
  106245 | role1              | admin          |
  106246 | role2              | admin          |
  106247 | role3              | admin          |
  106248 | teleport-auto-user | teleport-admin |

@greedy52 I'm missing something ?

[greedy52]

Seems caused by missing spaces. fixed in dc1cdc4.

Could you give it a try?

This is so weird that it worked for my user STeve. I think because QUOTE_IDENT has no effect on username with only lower cases. Even then, we are supposed to see CREATE USER failed first before the grant. I played around a little bit more but so far seems just Redshift weirdness. Doc didn't say much either.

[smallinsky]

Yes, After dc1cdc4 my setup works. Thanks for the alignment.

[public-teleport-github-review-bot]

@greedy52 See the table below for backport results.

Branch	Result
branch/v14	Failed

[public-teleport-github-review-bot]

@greedy52 See the table below for backport results.

Branch	Result
branch/v14	Failed