Which privileges should Apicurio database user have?

[iankotzekov]

Hi ,
does anybody know which privileges the database user for apicurio-shema-registry must have?
Using it with the superuser "postgres" on my local maschine works, but for the real usage we do not want to uset this user. With another user I get messages "Access permissions needed. To access this Service Registry instance, contact your organization administrators."
H-m-m, which "administrator" :-)
And in the Pod logs no messages at all...
Has somebody an idea how to solve the problem?

[EricWittmann]

Oh my - this is an old question that I never noticed. So sorry.

There are two things going on here. The first is what permissions does registry need to access the PG db. The answer is it depends on whether you want registry to create the tables for you or not. Some companies have DBAs that want to vet and run any DDLs that create tables in a DB. If you do that, then you'll need this (for example):

https://github.com/Apicurio/apicurio-registry/blob/2.5.x/app/src/main/resources/io/apicurio/registry/storage/impl/sql/postgresql.ddl

And then you just need to give the application standard table write permissions. I'm not a DBA so I don't recall offhand the technical specifics in PG of what that means, sorry.

If you want the application to just install the DDL itself, then the app will need elevated PG permissions: specifically the ability to create tables in the PG database.

Now, as for the other problem you report, which is the Access permissions needed. To access this Service Registry instance, contact your organization administrators. message. I'm surprised you got this error with ONLY a change of PG user. Are you sure that's the only difference? I would need to try and recreate that...

But that message usually indicates that you have enabled application-managed access controls (vs. IDP managed access). If you enable app managed access, then an authenticated user will not automatically have access to the registry - an "admin" user will need to grant access via the Registry UI. We have docs about this here:

https://www.apicur.io/registry/docs/apicurio-registry/2.5.x/getting-started/assembly-configuring-registry-security.html#registry-security-rbac-enabled

Look for the section titled Apicurio Registry admin-override configuration.