{"action":"opened","issue":{"url":"https://api.github.com/repos/glowroot/glowroot/issues/505","repository_url":"https://api.github.com/repos/glowroot/glowroot","labels_url":"https://api.github.com/repos/glowroot/glowroot/issues/505/labels{/name}","comments_url":"https://api.github.com/repos/glowroot/glowroot/issues/505/comments","events_url":"https://api.github.com/repos/glowroot/glowroot/issues/505/events","html_url":"https://github.com/glowroot/glowroot/issues/505","id":395783569,"node_id":"MDU6SXNzdWUzOTU3ODM1Njk=","number":505,"title":"Glowroot Cassandra user needs create on all keyspaces","user":{"login":"ReillyProcentive","id":10236182,"node_id":"MDQ6VXNlcjEwMjM2MTgy","avatar_url":"https://avatars1.githubusercontent.com/u/10236182?v=4","gravatar_id":"","url":"https://api.github.com/users/ReillyProcentive","html_url":"https://github.com/ReillyProcentive","followers_url":"https://api.github.com/users/ReillyProcentive/followers","following_url":"https://api.github.com/users/ReillyProcentive/following{/other_user}","gists_url":"https://api.github.com/users/ReillyProcentive/gists{/gist_id}","starred_url":"https://api.github.com/users/ReillyProcentive/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ReillyProcentive/subscriptions","organizations_url":"https://api.github.com/users/ReillyProcentive/orgs","repos_url":"https://api.github.com/users/ReillyProcentive/repos","events_url":"https://api.github.com/users/ReillyProcentive/events{/privacy}","received_events_url":"https://api.github.com/users/ReillyProcentive/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-01-04T01:40:43Z","updated_at":"2019-01-04T01:40:43Z","closed_at":null,"author_association":"NONE","body":"Hello, we recently enabled password authentication and RBAC on the Cassandra cluster that is utlized by our Glowroot Central server. Everything seemed to work at first however the next day we noticed that our Glowroot agents were emitting errors about being unable to connect. After investigation the following error was discovered on the central server:\r\n\r\n\r\n```2019-01-04 01:19:03.906 INFO  com.datastax.driver.core.Cluster - New Cassandra host cassandra/100.98.0.0:9042 added\r\n2019-01-04 01:19:03.906 INFO  com.datastax.driver.core.Cluster - New Cassandra host cassandra/100.99.0.1:9042 added\r\n2019-01-04 01:19:03.906 INFO  com.datastax.driver.core.Cluster - New Cassandra host cassandra/100.122.0.1:9042 added\r\n2019-01-04 01:19:04.175 ERROR org.glowroot - User glowroot has no CREATE permission on <all keyspaces> or any of its parents\r\ncom.datastax.driver.core.exceptions.UnauthorizedException: User glowroot has no CREATE permission on <all keyspaces> or any of its parents\r\n\tat com.datastax.driver.core.exceptions.UnauthorizedException.copy(UnauthorizedException.java:56)\r\n\tat com.datastax.driver.core.exceptions.UnauthorizedException.copy(UnauthorizedException.java:25)\r\n\tat com.datastax.driver.core.DriverThrowables.propagateCause(DriverThrowables.java:35)\r\n\tat com.datastax.driver.core.DefaultResultSetFuture.getUninterruptibly(DefaultResultSetFuture.java:293)\r\n\tat com.datastax.driver.core.AbstractSession.execute(AbstractSession.java:58)\r\n\tat com.datastax.driver.core.AbstractSession.execute(AbstractSession.java:39)\r\n\tat org.glowroot.central.util.Session.updateSchemaWithRetry(Session.java:442)\r\n\tat org.glowroot.central.util.Session.<init>(Session.java:99)\r\n\tat org.glowroot.central.CentralModule.connect(CentralModule.java:736)\r\n\tat org.glowroot.central.CentralModule.<init>(CentralModule.java:160)\r\n\tat org.glowroot.central.CentralModule.create(CentralModule.java:120)\r\n\tat org.glowroot.central.CentralModule.create(CentralModule.java:115)\r\n\tat org.glowroot.central.Main.start(Main.java:44)\r\n\tat org.glowroot.central.Main.main(Main.java:28)\r\nCaused by: com.datastax.driver.core.exceptions.UnauthorizedException: User glowroot has no CREATE permission on <all keyspaces> or any of its parents\r\n\tat com.datastax.driver.core.Responses$Error.asException(Responses.java:179)\r\n\tat com.datastax.driver.core.DefaultResultSetFuture.onSet(DefaultResultSetFuture.java:215)\r\n\tat com.datastax.driver.core.RequestHandler.setFinalResult(RequestHandler.java:226)\r\n\tat com.datastax.driver.core.RequestHandler.access$2600(RequestHandler.java:62)\r\n\tat com.datastax.driver.core.RequestHandler$SpeculativeExecution.setFinalResult(RequestHandler.java:986)\r\n\tat com.datastax.driver.core.RequestHandler$SpeculativeExecution.onSet(RequestHandler.java:789)\r\n\tat com.datastax.driver.core.Connection$Dispatcher.channelRead0(Connection.java:1233)\r\n\tat com.datastax.driver.core.Connection$Dispatcher.channelRead0(Connection.java:1151)\r\n\tat io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:105)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)\r\n\tat io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)\r\n\tat io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)\r\n\tat io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:310)\r\n\tat io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:284)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)\r\n\tat io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:86)\r\n\tat com.datastax.driver.core.InboundTrafficMeter.channelRead(InboundTrafficMeter.java:38)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)\r\n\tat io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)\r\n\tat io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)\r\n\tat io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)\r\n\tat io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)\r\n\tat io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:646)\r\n\tat io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:546)\r\n\tat io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:500)\r\n\tat io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:460)\r\n\tat io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)\r\n\tat io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)\r\n\tat java.base/java.lang.Thread.run(Thread.java:834)\r\n```\r\n\r\nI'm not sure why Glowroot needs the create on all keyspaces permission given that it has all permissions on the `glowroot` keyspace which is already created. I was able to (for now) fix this by granting that permission but just wanted to double check here that that permission is actually needed by Glowroot.\r\n\r\nFor reference here our our permissions before:\r\n```\r\nadmin@cqlsh> list all of glowroot;\r\n\r\n role     | username | resource            | permission\r\n----------+----------+---------------------+------------\r\n glowroot | glowroot | <keyspace glowroot> |     CREATE\r\n glowroot | glowroot | <keyspace glowroot> |      ALTER\r\n glowroot | glowroot | <keyspace glowroot> |       DROP\r\n glowroot | glowroot | <keyspace glowroot> |     SELECT\r\n glowroot | glowroot | <keyspace glowroot> |     MODIFY\r\n glowroot | glowroot | <keyspace glowroot> |  AUTHORIZE\r\n```\r\n\r\nAnd this worked:\r\n```admin@cqlsh> list all of glowroot;\r\n\r\n role     | username | resource            | permission\r\n----------+----------+---------------------+------------\r\n glowroot | glowroot |     <all keyspaces> |     CREATE\r\n glowroot | glowroot | <keyspace glowroot> |     CREATE\r\n glowroot | glowroot | <keyspace glowroot> |      ALTER\r\n glowroot | glowroot | <keyspace glowroot> |       DROP\r\n glowroot | glowroot | <keyspace glowroot> |     SELECT\r\n glowroot | glowroot | <keyspace glowroot> |     MODIFY\r\n glowroot | glowroot | <keyspace glowroot> |  AUTHORIZE\r\n```"}}
{"actor":{"display_login":"ReillyProcentive"}}