[Bug]: RBAC user created collection

[highvelcty]

[Bug]: RBAC user created collection

[SimFG]

@highvelcty I tried using your script and no errors were found. And the collection was created correctly

[SimFG]

can you give me more information about the milvus and pymilvus version, and completed error message.

[yanliang567]

/assign @highvelcty
/unassign

[highvelcty]

Hi @yanliang567 ,

Thank you for looking into this with me.

I initialized my entire system and I was able to create a user specific collection without error. I wonder if there was something with the state of my machine that was causing the trouble.

However, I tried listing the created collections with a non-root user, but an empty list was returned.

These permissions have been provided to the role assigned to the user (see line 71 of create_user_collection.py):

    root_client.grant_privilege(role_name=USERROLE,
                                object_type='Global',
                                privilege='All',
                                object_name='*')
    root_client.grant_privilege(role_name=USERROLE,
                                object_type='Global',
                                privilege='CreateCollection',
                                object_name='CreateCollection')
    root_client.grant_privilege(role_name=USERROLE,
                                object_type='Global',
                                privilege='ShowCollections',
                                object_name='ShowCollections')

I updated this the create_user_collections.py script to print the collection listing via the non-root user client (see line 149).

# ./create_user_collection.py 
root client list collections: ['user_collection']
user1 list collections: []
#

The expectcation is that either the "Global/All/*" or the "Global/ShowCollections/ShowCollections" permissions should have allowed the non-root user to list collections.

[highvelcty]

I see the "user1 client list collections: []" output with the following version sets:

- Milvus version: 2.4.1
- SDK version: 2.4.1

- Milvus version: 2.4.1
- SDK version: 2.4.3

[yanliang567]

I tried to run the script above, and only update the milvus host with my deployment. it seems it returns the collections successfully, is that your expectation?

my milvus and sdk version:

• Milvus version: 2.4.1
• SDK version: 2.4.3

[SimFG]

@highvelcty I have found the cause of the problem. A temporary solution is to grant this role the relevant permissions of a collection, for example:

root_client.grant_privilege(role_name=USERROLE,
                                object_type='Collection',
                                privilege='Insert',
                                object_name='*')

I will fix it in the next version

[highvelcty]

Great! Thank you @SimFG and @yanliang567!