[Bug]: CreatePrivilegeGroup permission denied after revoking the privilege but there is still ClusterAdmin granted

[shaoting-huang]

Is there an existing issue for this?

• I have searched the existing issues

Environment

- Milvus version:master
- Deployment mode(standalone or cluster):
- MQ type(rocksmq, pulsar or kafka):    
- SDK version(e.g. pymilvus v2.0.0rc2):
- OS(Ubuntu or CentOS): 
- CPU/Memory: 
- GPU: 
- Others:

Current Behavior

1. grant CreatePrivilegeGroup and ClusterAdmin to the role at the same time
2. revoke CreatePrivilegeGroup from the role
3. try to operate CreatePrivilegeGroup

Expected Behavior

should have permission since there is still ClusterAdmin granted.

Steps To Reproduce

>>> role.grant_v2("CreatePrivilegeGroup", "*", db_name="*")
>>> role.list_grants()
GrantInfo groups:
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:role>, <grantor_name:root>, <privilege:CreatePrivilegeGroup>
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:role>, <grantor_name:root>, <privilege:ClusterAdmin>
>>> connections.disconnect('default')
>>> connections.connect(host="localhost", user="user1", password="Milvus")
>>> role.create_privilege_group("pg")
>>> connections.connect(host="localhost", user="root", password="Milvus")
>>> client = MilvusClient(uri="http://localhost:19530", user="root", password="Milvus")
>>> role.revoke_v2("CreatePrivilegeGroup", "*", db_name="*")
>>> connections.disconnect('default')
>>> connections.connect(host="localhost", user="user1", password="Milvus")
>>> role.create_privilege_group("pg2")

Milvus Log

grpc RpcError: [create_privilege_group], <_InactiveRpcError: StatusCode.PERMISSION_DENIED, PrivilegeCreatePrivilegeGroup: permission deny to user1 in the default database>, <Time:{'RPC start': '2024-12-18 16:29:35.182185', 'gRPC error': '2024-12-18 16:29:35.183008'}>

Anything else?

No response

[yanliang567]

/assign @shaoting-huang
/unassign

[binbinlv]

Verified and fixed in 2.4 branch:
milvus: 2.4-20241218-d84e4f6e-amd64

results:

>>> role.revoke_v2("CreatePrivilegeGroup", "*", db_name="*")
>>> role.list_grants()
GrantInfo groups:
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:role1>, <grantor_name:root>, <privilege:ClusterAdmin>
>>>
>>>
>>> connections.disconnect('default')
>>> connections.connect(host="10.101.85.251", user="user1", password="Milvus")
>>>
>>> role.create_privilege_group("pg2")
>>>
>>>

[binbinlv]

Verifying in master branch.

[binbinlv]

Verified and fixed in master branch:
milvus: master-20241218-de885893-amd64

results:

>>> role.list_grants()
GrantInfo groups:
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:role_1>, <grantor_name:root>, <privilege:CreatePrivilegeGroup>
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:role_1>, <grantor_name:root>, <privilege:ClusterAdmin>
>>>
>>>
>>> connections.disconnect('default')
>>> connections.connect(host="***", user="user1", password="Milvus")
>>>
>>>
>>> role.create_privilege_group("pg")
>>> connections.connect(host="***", user="root", password="Milvus")
>>> role.revoke_v2("CreatePrivilegeGroup", "*", db_name="*")
>>> role.list_grants()
GrantInfo groups:
- GrantItem: <object:Global>, <object_name:*>, <db_name:*>, <role_name:role_1>, <grantor_name:root>, <privilege:ClusterAdmin>
>>>
>>>
>>> connections.disconnect('default')
>>> connections.connect(host="***", user="user1", password="Milvus")
>>>
>>>
>>> role.create_privilege_group("pg2")
>>> role.drop_privilege_group("pg2")
>>>