Skip to content

Commit acc3870

Browse files
yurikiselevyurikiselev
authored
Add grants for groups (#26063)
1 parent 6def0f2 commit acc3870

File tree

9 files changed

+146
-53
lines changed

9 files changed

+146
-53
lines changed

‎ydb/core/kqp/common/events/script_executions.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
#include <ydb/core/protos/kqp.pb.h>
44
#include <ydb/core/protos/kqp_stats.pb.h>
55
#include <ydb/core/protos/kqp_physical.pb.h>
6+
#include <ydb/library/aclib/aclib.h>
67
#include <yql/essentials/public/issue/yql_issue.h>
78
#include <ydb/public/api/protos/ydb_operation.pb.h>
89
#include <ydb/public/api/protos/ydb_query.pb.h>
@@ -281,7 +282,7 @@ struct TEvSaveScriptExternalEffectRequest : public TEventLocal<TEvSaveScriptExte
281282
TString Database;
282283

283284
TString CustomerSuppliedId;
284-
TString UserToken;
285+
TIntrusiveConstPtr<NACLib::TUserToken> UserToken;
285286
std::vector<NKqpProto::TKqpExternalSink> Sinks;
286287
std::vector<TString> SecretNames;
287288
};
@@ -386,7 +387,7 @@ struct TEvSaveScriptFinalStatusResponse : public TEventLocal<TEvSaveScriptFinalS
386387
bool OperationAlreadyFinalized = false;
387388
bool WaitRetry = false;
388389
TString CustomerSuppliedId;
389-
TString UserToken;
390+
TIntrusiveConstPtr<NACLib::TUserToken> UserToken;
390391
std::vector<NKqpProto::TKqpExternalSink> Sinks;
391392
std::vector<TString> SecretNames;
392393
Ydb::StatusIds::StatusCode Status;

‎ydb/core/kqp/executer_actor/kqp_executer_impl.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -941,7 +941,7 @@ class TKqpExecuterBase : public TActor<TDerived> {
941941
}
942942

943943
void GetSecretsSnapshot() {
944-
RegisterDescribeSecretsActor(this->SelfId(), UserToken ? UserToken->GetUserSID() : "", SecretNames, this->ActorContext().ActorSystem());
944+
RegisterDescribeSecretsActor(this->SelfId(), UserToken, SecretNames, this->ActorContext().ActorSystem());
945945
}
946946

947947
void GetResourcesSnapshot() {

‎ydb/core/kqp/federated_query/kqp_federated_query_actors.cpp‎

Lines changed: 28 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -216,19 +216,19 @@ void TDescribeSchemaSecretsService::SaveIncomingRequestInfo(const TEvResolveSecr
216216
ResolveInFlight[LastCookie] = std::move(ctx);
217217
}
218218

219-
void TDescribeSchemaSecretsService::SendSchemeCacheRequests(const TVector<TString>& secretNames, const NACLib::TUserToken& userToken) {
219+
void TDescribeSchemaSecretsService::SendSchemeCacheRequests(const TVector<TString>& secretNames, const TIntrusiveConstPtr<NACLib::TUserToken> userToken) {
220220
TAutoPtr<NSchemeCache::TSchemeCacheNavigate> request(new NSchemeCache::TSchemeCacheNavigate());
221221
for (const auto& secretName : secretNames) {
222222
NSchemeCache::TSchemeCacheNavigate::TEntry entry;
223223
entry.Operation = NSchemeCache::TSchemeCacheNavigate::OpPath;
224224
entry.Path = SplitPath(secretName);
225-
if (userToken.GetUserSID()) {
225+
if (userToken && userToken->GetUserSID()) {
226226
entry.Access = NACLib::SelectRow;
227227
}
228228
request->ResultSet.emplace_back(entry);
229229
}
230-
if (userToken.GetUserSID()) {
231-
request->UserToken = new NACLib::TUserToken(userToken);
230+
if (userToken && userToken->GetUserSID()) {
231+
request->UserToken = userToken;
232232
}
233233

234234
Send(MakeSchemeCacheID(), new TEvTxProxySchemeCache::TEvNavigateKeySet(request), 0, LastCookie++);
@@ -305,7 +305,11 @@ void TDescribeSchemaSecretsService::HandleNotifyDelete(TSchemeBoardEvents::TEvNo
305305
SchemeBoardSubscribers.erase(subscriberIt);
306306
}
307307

308-
NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> DescribeSecret(const TVector<TString>& secretNames, const TString& ownerUserId, TActorSystem* actorSystem) {
308+
NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> DescribeSecret(
309+
const TVector<TString>& secretNames,
310+
const TIntrusiveConstPtr<NACLib::TUserToken> userToken,
311+
TActorSystem* actorSystem
312+
) {
309313
auto promise = NThreading::NewPromise<TEvDescribeSecretsResponse::TDescription>();
310314
if (actorSystem->AppData<TAppData>()->FeatureFlags.GetEnableSchemaSecrets()) {
311315
bool schemaSecrets = false;
@@ -318,53 +322,62 @@ NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> DescribeSecret(con
318322
if (schemaSecrets) {
319323
actorSystem->Send(
320324
MakeKqpDescribeSchemaSecretServiceId(actorSystem->NodeId),
321-
new TDescribeSchemaSecretsService::TEvResolveSecret(ownerUserId, secretNames, promise));
325+
new TDescribeSchemaSecretsService::TEvResolveSecret(userToken, secretNames, promise));
322326
return promise.GetFuture();
323327
}
324328
}
325329

326-
actorSystem->Register(CreateDescribeSecretsActor(ownerUserId, secretNames, promise));
330+
actorSystem->Register(CreateDescribeSecretsActor(userToken ? userToken->GetUserSID() : "", secretNames, promise));
327331
return promise.GetFuture();
328332
}
329333

330-
void RegisterDescribeSecretsActor(const NActors::TActorId& replyActorId, const TString& ownerUserId, const std::vector<TString>& secretIds, NActors::TActorSystem* actorSystem) {
334+
void RegisterDescribeSecretsActor(
335+
const NActors::TActorId& replyActorId,
336+
const TIntrusiveConstPtr<NACLib::TUserToken> userToken,
337+
const std::vector<TString>& secretIds,
338+
NActors::TActorSystem* actorSystem
339+
) {
331340
TVector<TString> secretNames{secretIds.begin(), secretIds.end()};
332-
auto future = DescribeSecret(secretNames, ownerUserId, actorSystem);
341+
auto future = DescribeSecret(secretNames, userToken, actorSystem);
333342
future.Subscribe([actorSystem, replyActorId](const NThreading::TFuture<TEvDescribeSecretsResponse::TDescription>& result){
334343
actorSystem->Send(replyActorId, new TEvDescribeSecretsResponse(result.GetValue()));
335344
});
336345
}
337346

338-
NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> DescribeExternalDataSourceSecrets(const NKikimrSchemeOp::TAuth& authDescription, const TString& ownerUserId, TActorSystem* actorSystem) {
347+
NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> DescribeExternalDataSourceSecrets(
348+
const NKikimrSchemeOp::TAuth& authDescription,
349+
const TIntrusiveConstPtr<NACLib::TUserToken> userToken,
350+
TActorSystem* actorSystem
351+
) {
339352
switch (authDescription.identity_case()) {
340353
case NKikimrSchemeOp::TAuth::kServiceAccount: {
341354
const TString& saSecretId = authDescription.GetServiceAccount().GetSecretName();
342-
return DescribeSecret({saSecretId}, ownerUserId, actorSystem);
355+
return DescribeSecret({saSecretId}, userToken, actorSystem);
343356
}
344357

345358
case NKikimrSchemeOp::TAuth::kNone:
346359
return NThreading::MakeFuture(TEvDescribeSecretsResponse::TDescription({}));
347360

348361
case NKikimrSchemeOp::TAuth::kBasic: {
349362
const TString& passwordSecretId = authDescription.GetBasic().GetPasswordSecretName();
350-
return DescribeSecret({passwordSecretId}, ownerUserId, actorSystem);
363+
return DescribeSecret({passwordSecretId}, userToken, actorSystem);
351364
}
352365

353366
case NKikimrSchemeOp::TAuth::kMdbBasic: {
354367
const TString& saSecretId = authDescription.GetMdbBasic().GetServiceAccountSecretName();
355368
const TString& passwordSecreId = authDescription.GetMdbBasic().GetPasswordSecretName();
356-
return DescribeSecret({saSecretId, passwordSecreId}, ownerUserId, actorSystem);
369+
return DescribeSecret({saSecretId, passwordSecreId}, userToken, actorSystem);
357370
}
358371

359372
case NKikimrSchemeOp::TAuth::kAws: {
360373
const TString& awsAccessKeyIdSecretId = authDescription.GetAws().GetAwsAccessKeyIdSecretName();
361374
const TString& awsAccessKeyKeySecretId = authDescription.GetAws().GetAwsSecretAccessKeySecretName();
362-
return DescribeSecret({awsAccessKeyIdSecretId, awsAccessKeyKeySecretId}, ownerUserId, actorSystem);
375+
return DescribeSecret({awsAccessKeyIdSecretId, awsAccessKeyKeySecretId}, userToken, actorSystem);
363376
}
364377

365378
case NKikimrSchemeOp::TAuth::kToken: {
366379
const TString& tokenSecretId = authDescription.GetToken().GetTokenSecretName();
367-
return DescribeSecret({tokenSecretId}, ownerUserId, actorSystem);
380+
return DescribeSecret({tokenSecretId}, userToken, actorSystem);
368381
}
369382

370383
case NKikimrSchemeOp::TAuth::IDENTITY_NOT_SET:

‎ydb/core/kqp/federated_query/kqp_federated_query_actors.h‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,18 @@ class TDescribeSchemaSecretsService: public NActors::TActorBootstrapped<TDescrib
2525
struct TEvResolveSecret : public NActors::TEventLocal<TEvResolveSecret, EvResolveSecret> {
2626
public:
2727
TEvResolveSecret(
28-
const TString& ownerUserId,
28+
const TIntrusiveConstPtr<NACLib::TUserToken> userToken,
2929
const TVector<TString>& secretNames,
3030
NThreading::TPromise<TEvDescribeSecretsResponse::TDescription> promise
3131
)
32-
: UserToken(NACLib::TUserToken{ownerUserId, TVector<NACLib::TSID>{}})
32+
: UserToken(userToken)
3333
, SecretNames(secretNames)
3434
, Promise(promise)
3535
{
3636
}
3737

3838
public:
39-
const NACLib::TUserToken UserToken;
39+
const TIntrusiveConstPtr<NACLib::TUserToken> UserToken;
4040
const TVector<TString> SecretNames;
4141
NThreading::TPromise<TEvDescribeSecretsResponse::TDescription> Promise;
4242
};
@@ -74,7 +74,7 @@ class TDescribeSchemaSecretsService: public NActors::TActorBootstrapped<TDescrib
7474

7575
void FillResponse(const ui64& requestId, const TEvDescribeSecretsResponse::TDescription& response);
7676
void SaveIncomingRequestInfo(const TEvResolveSecret& req);
77-
void SendSchemeCacheRequests(const TVector<TString>& secretNames, const NACLib::TUserToken& userToken);
77+
void SendSchemeCacheRequests(const TVector<TString>& secretNames, const TIntrusiveConstPtr<NACLib::TUserToken> userToken);
7878
bool LocalCacheHasActualVersion(const TVersionedSecret& secret, const ui64& cacheSecretVersion);
7979
bool LocalCacheHasActualObject(const TVersionedSecret& secret, const ui64& cacheSecretPathId);
8080
bool HandleSchemeCacheErrorsIfAny(const ui64& requestId, NSchemeCache::TSchemeCacheNavigate& result);
@@ -104,9 +104,18 @@ class TDescribeSchemaSecretsService: public NActors::TActorBootstrapped<TDescrib
104104
ISecretUpdateListener* SecretUpdateListener;
105105
};
106106

107-
void RegisterDescribeSecretsActor(const TActorId& replyActorId, const TString& ownerUserId, const std::vector<TString>& secretIds, TActorSystem* actorSystem);
108-
109-
NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> DescribeExternalDataSourceSecrets(const NKikimrSchemeOp::TAuth& authDescription, const TString& ownerUserId, TActorSystem* actorSystem);
107+
void RegisterDescribeSecretsActor(
108+
const NActors::TActorId& replyActorId,
109+
const TIntrusiveConstPtr<NACLib::TUserToken> userToken,
110+
const std::vector<TString>& secretIds,
111+
NActors::TActorSystem* actorSystem
112+
);
113+
114+
NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> DescribeExternalDataSourceSecrets(
115+
const NKikimrSchemeOp::TAuth& authDescription,
116+
const TIntrusiveConstPtr<NACLib::TUserToken> userToken,
117+
TActorSystem* actorSystem
118+
);
110119

111120
IActor* CreateDescribeSchemaSecretsService();
112121

‎ydb/core/kqp/federated_query/kqp_federated_query_actors_ut.cpp‎

Lines changed: 66 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,23 +26,30 @@ namespace {
2626
}
2727

2828
NThreading::TPromise<NKikimr::NKqp::TEvDescribeSecretsResponse::TDescription>
29-
ResolveSecret(const TVector<TString>& secretNames, NKikimr::NKqp::TKikimrRunner& kikimr, const TString& userId = "") {
29+
ResolveSecret(const TVector<TString>& secretNames, NKikimr::NKqp::TKikimrRunner& kikimr, const TIntrusiveConstPtr<NACLib::TUserToken> userToken = nullptr) {
3030
auto promise = NThreading::NewPromise<NKikimr::NKqp::TEvDescribeSecretsResponse::TDescription>();
31-
const auto evResolveSecret = new NKikimr::NKqp::TDescribeSchemaSecretsService::TEvResolveSecret(userId, secretNames, promise);
31+
const auto evResolveSecret = new NKikimr::NKqp::TDescribeSchemaSecretsService::TEvResolveSecret(userToken, secretNames, promise);
3232
auto actorSystem = kikimr.GetTestServer().GetRuntime()->GetActorSystem(0);
3333
actorSystem->Send(NKikimr::NKqp::MakeKqpDescribeSchemaSecretServiceId(actorSystem->NodeId), evResolveSecret);
3434
return promise;
3535
}
3636

3737
NThreading::TPromise<NKikimr::NKqp::TEvDescribeSecretsResponse::TDescription>
38-
ResolveSecret(const TString& secretName, NKikimr::NKqp::TKikimrRunner& kikimr, const TString& userId = "") {
39-
return ResolveSecret(TVector<TString>{secretName}, kikimr, userId);
38+
ResolveSecret(const TString& secretName, NKikimr::NKqp::TKikimrRunner& kikimr, const TIntrusiveConstPtr<NACLib::TUserToken> userToken = nullptr) {
39+
return ResolveSecret(TVector<TString>{secretName}, kikimr, userToken);
4040
}
4141

4242
void AssertBadRequest(NThreading::TPromise<NKikimr::NKqp::TEvDescribeSecretsResponse::TDescription> promise, const TString& err) {
4343
UNIT_ASSERT_VALUES_EQUAL(Ydb::StatusIds::BAD_REQUEST, promise.GetFuture().GetValueSync().Status);
4444
UNIT_ASSERT_VALUES_EQUAL(err, promise.GetFuture().GetValueSync().Issues.ToString());
4545
}
46+
47+
TIntrusiveConstPtr<NACLib::TUserToken> GetUserToken(const TString& userSid = "", const TVector<TString>& groupSids = {}) {
48+
if (userSid.empty() && groupSids.empty()) {
49+
return nullptr;
50+
}
51+
return new NACLib::TUserToken(userSid, groupSids);
52+
}
4653
}
4754

4855
Y_UNIT_TEST_SUITE(DescribeSchemaSecretsService) {
@@ -201,11 +208,12 @@ Y_UNIT_TEST_SUITE(DescribeSchemaSecretsService) {
201208

202209
CreateSchemaSecret(secretName, secretValue, adminSession);
203210

204-
auto promise = ResolveSecret(secretName, kikimr, "root@builtin");
211+
auto promise = ResolveSecret(secretName, kikimr, GetUserToken("root@builtin"));
205212
UNIT_ASSERT_VALUES_EQUAL(secretValue, promise.GetFuture().GetValueSync().SecretValues[0]);
206213

214+
const auto userToken = GetUserToken("user@builtin");
207215
{ // assert no grants by default
208-
auto promise = ResolveSecret("/Root/secret-name", kikimr, "user@builtin");
216+
auto promise = ResolveSecret("/Root/secret-name", kikimr, userToken);
209217
AssertBadRequest(promise, "<main>: Error: secret `/Root/secret-name` not found\n");
210218
}
211219

@@ -216,7 +224,7 @@ Y_UNIT_TEST_SUITE(DescribeSchemaSecretsService) {
216224
UNIT_ASSERT_C(grantResult.GetStatus() == NYdb::EStatus::SUCCESS, grantResult.GetIssues().ToString());
217225

218226
{ // assert grants are ok
219-
auto promise = ResolveSecret("/Root/secret-name", kikimr, "user@builtin");
227+
auto promise = ResolveSecret("/Root/secret-name", kikimr, userToken);
220228
UNIT_ASSERT_VALUES_EQUAL(secretValue, promise.GetFuture().GetValueSync().SecretValues[0]);
221229
}
222230

@@ -227,7 +235,54 @@ Y_UNIT_TEST_SUITE(DescribeSchemaSecretsService) {
227235
UNIT_ASSERT_C(revokeResult.GetStatus() == NYdb::EStatus::SUCCESS, grantResult.GetIssues().ToString());
228236

229237
{ // assert no grants after revoking
230-
auto promise = ResolveSecret("/Root/secret-name", kikimr, "user@builtin");
238+
auto promise = ResolveSecret("/Root/secret-name", kikimr, userToken);
239+
AssertBadRequest(promise, "<main>: Error: secret `/Root/secret-name` not found\n");
240+
}
241+
}
242+
243+
Y_UNIT_TEST(GroupGrants) {
244+
NKikimr::NKqp::TKikimrRunner kikimr;
245+
kikimr.GetTestServer().GetRuntime()->GetAppData(0).FeatureFlags.SetEnableSchemaSecrets(true);
246+
247+
const TString secretName = "/Root/secret-name";
248+
const TString secretValue = "secret-value";
249+
auto adminSession = kikimr.GetTableClient(NYdb::NTable::TClientSettings().AuthToken("root@builtin"))
250+
.CreateSession().GetValueSync().GetSession();
251+
252+
CreateSchemaSecret(secretName, secretValue, adminSession);
253+
254+
auto promise = ResolveSecret(secretName, kikimr, GetUserToken("root@builtin"));
255+
UNIT_ASSERT_VALUES_EQUAL(secretValue, promise.GetFuture().GetValueSync().SecretValues[0]);
256+
257+
const auto userToken = GetUserToken("user@builtin", {"group"});
258+
{ // assert no grants by default
259+
auto promise = ResolveSecret("/Root/secret-name", kikimr, userToken);
260+
AssertBadRequest(promise, "<main>: Error: secret `/Root/secret-name` not found\n");
261+
}
262+
263+
const auto createGroupResult = adminSession.ExecuteSchemeQuery(
264+
Sprintf("CREATE GROUP `group` WITH USER `user@builtin`;")
265+
).GetValueSync();
266+
UNIT_ASSERT_C(createGroupResult.GetStatus() == NYdb::EStatus::SUCCESS, createGroupResult.GetIssues().ToString());
267+
268+
const auto grantResult = adminSession.ExecuteSchemeQuery(
269+
Sprintf("GRANT 'ydb.granular.select_row' ON `%s` TO `%s`;", secretName.data(), "group")
270+
).GetValueSync();
271+
UNIT_ASSERT_C(grantResult.GetStatus() == NYdb::EStatus::SUCCESS, grantResult.GetIssues().ToString());
272+
273+
{ // assert group grants are ok
274+
auto promise = ResolveSecret("/Root/secret-name", kikimr, userToken);
275+
UNIT_ASSERT_VALUES_EQUAL(secretValue, promise.GetFuture().GetValueSync().SecretValues[0]);
276+
}
277+
278+
// revoke grants
279+
const auto revokeResult = adminSession.ExecuteSchemeQuery(
280+
Sprintf("REVOKE 'ydb.granular.select_row' ON `%s` FROM `%s`;", secretName.data(), "group")
281+
).GetValueSync();
282+
UNIT_ASSERT_C(revokeResult.GetStatus() == NYdb::EStatus::SUCCESS, grantResult.GetIssues().ToString());
283+
284+
{ // assert no grants after revoking
285+
auto promise = ResolveSecret("/Root/secret-name", kikimr, userToken);
231286
AssertBadRequest(promise, "<main>: Error: secret `/Root/secret-name` not found\n");
232287
}
233288
}
@@ -331,8 +386,9 @@ Y_UNIT_TEST_SUITE(DescribeSchemaSecretsService) {
331386
).GetValueSync();
332387
UNIT_ASSERT_C(grantResult.GetStatus() == NYdb::EStatus::SUCCESS, grantResult.GetIssues().ToString());
333388

389+
auto userToken = GetUserToken("user@builtin");
334390
{ // user has grants for names[0], has no grants for names[1]
335-
auto promise = ResolveSecret({names[0], names[1]}, kikimr, "user@builtin");
391+
auto promise = ResolveSecret({names[0], names[1]}, kikimr, userToken);
336392
AssertBadRequest(promise, "<main>: Error: secret `/Root/secret-name-1` not found\n");
337393
}
338394

@@ -342,7 +398,7 @@ Y_UNIT_TEST_SUITE(DescribeSchemaSecretsService) {
342398
UNIT_ASSERT_C(grantResult.GetStatus() == NYdb::EStatus::SUCCESS, grantResult.GetIssues().ToString());
343399

344400
{ // user has grants for all names[0]
345-
auto promise = ResolveSecret({names[0], names[1]}, kikimr, "user@builtin");
401+
auto promise = ResolveSecret({names[0], names[1]}, kikimr, userToken);
346402
for (size_t i = 0; i < values.size(); ++i) {
347403
UNIT_ASSERT_VALUES_EQUAL(values[i], promise.GetFuture().GetValueSync().SecretValues[i]);
348404
}

‎ydb/core/kqp/finalize_script_service/kqp_finalize_script_actor.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ class TScriptFinalizerActor : public TActorBootstrapped<TScriptFinalizerActor> {
226226
TString CustomerSuppliedId;
227227
std::vector<NKqpProto::TKqpExternalSink> Sinks;
228228

229-
TString UserToken;
229+
TIntrusiveConstPtr<NACLib::TUserToken> UserToken;
230230
std::vector<TString> SecretNames;
231231
std::unordered_map<TString, TString> SecureParams;
232232
};

‎ydb/core/kqp/gateway/behaviour/external_data_source/manager.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ using TYqlConclusion = TConclusionImpl<TYqlConclusionStatus, TValue>;
2424

2525
TAsyncStatus ValidateExternalDatasourceSecrets(const NKikimrSchemeOp::TExternalDataSourceDescription& externalDataSourceDesc, const TExternalDataSourceManager::TInternalModificationContext& context) {
2626
const auto& externalData = context.GetExternalData();
27-
const auto& userToken = externalData.GetUserToken();
28-
auto describeFuture = DescribeExternalDataSourceSecrets(externalDataSourceDesc.GetAuth(), userToken ? userToken->GetUserSID() : "", externalData.GetActorSystem());
27+
const std::optional<NACLib::TUserToken>& userToken = externalData.GetUserToken();
28+
auto describeFuture = DescribeExternalDataSourceSecrets(externalDataSourceDesc.GetAuth(), userToken ? new NACLib::TUserToken(*userToken) : nullptr, externalData.GetActorSystem());
2929

3030
return describeFuture.Apply([](const NThreading::TFuture<TEvDescribeSecretsResponse::TDescription>& f) {
3131
if (const auto& value = f.GetValue(); value.Status != Ydb::StatusIds::SUCCESS) {

‎ydb/core/kqp/gateway/kqp_metadata_loader.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -574,7 +574,7 @@ void UpdateExternalDataSourceSecretsValue(TTableMetadataResult& externalDataSour
574574

575575
NThreading::TFuture<TEvDescribeSecretsResponse::TDescription> LoadExternalDataSourceSecretValues(const NSchemeCache::TSchemeCacheNavigate::TEntry& entry, const TIntrusiveConstPtr<NACLib::TUserToken>& userToken, TActorSystem* actorSystem) {
576576
const auto& authDescription = entry.ExternalDataSourceInfo->Description.GetAuth();
577-
return DescribeExternalDataSourceSecrets(authDescription, userToken ? userToken->GetUserSID() : "", actorSystem);
577+
return DescribeExternalDataSourceSecrets(authDescription, userToken, actorSystem);
578578
}
579579

580580
} // anonymous namespace

0 commit comments

Comments
 (0)