GRANT ACCESS ON CONNECTION has noeffect for bucketfs connections

Detail name	Value
Changelog Number	12694
Type	Bug
Status	Resolved
Affected Versions	Exasol 6.2.0, Exasol 7.0.0, Exasol 7.1.0
Fix Versions	Exasol 7.0.12, Exasol 7.1.1
Resolution Date	2021-08-31

Description

GRANT ACCESS ON CONNECTION has no effect for bucketfs connections.

create schema Test;
--/
CREATE PYTHON SCALAR SCRIPT ls(my_path VARCHAR(100))
EMITS (files VARCHAR(100)) AS
import subprocess

def run(c):
    try:
      p = subprocess.Popen('ls '+c.my_path,
        stdout = subprocess.PIPE,
        stderr = subprocess.STDOUT,
        close_fds = True,
        shell = True)
      out, err = p.communicate()
      for line in out.strip().split('\n'):
        c.emit(line)
    finally:
      if p is not None:
        try: p.kill()
        except: pass
/


CREATE or replace CONNECTION bucket_access_test TO 'bucketfs:testing/testbucket'
  IDENTIFIED BY 'pw'; 

create user connection_user identified by "passwd";
grant create session to connection_user;
grant execute any script to connection_user;
-- The following statement should give the user access
grant access on connection bucket_access_test for script ls to connection_user;
impersonate connection_user;

-- But the user is still not allowed to see it. This is the bug.
select ls('/buckets/testing/testbucket'); -- ls: cannot access '/buckets/testing/testbucket': No such file or directory

Workaround

If each script is stored in a separate bucket, access can be managed on buckets with a GRANT CONNECTION statement to each bucket.

Fix

GRANT ACCESS ON CONNECTION works on bucketfs connections in the same way as for normal connections.