grantPrivilegeV2 Vs grantPrivilege

[shaiktas]

Hello Team,
We have db name in grantPrivilegeV2 API, but same is not available in grantPrivilege. So here if we are using grantPrivilege how to grant role /privilege to a specific db? Using grantPrivilege we able to grantPrivileges, in below we are targeting to grant all privilege at collection level for the role.

client.grantPrivilege(GrantPrivilegeReq.builder().roleName(role).
                       privilege("*")
                       .objectName("*")
                       .objectType("Collection").build()
               );

But when trying to create collection using above role privileges getting permission denied to user to create collection in default db. below is the describe role output:test_role description DescribeRoleResp(grantInfos=[DescribeRoleResp.GrantInfo(objectType=Collection, privilege=*, objectName=*, dbName=default, grantor=root)])

[xiaofan-luan]

Hello Team, We have db name in grantPrivilegeV2 API, but same is not available in grantPrivilege. So here if we are using grantPrivilege how to grant role /privilege to a specific db? Using grantPrivilege we able to grantPrivileges, in below we are targeting to grant all privilege at collection level for the role.

client.grantPrivilege(GrantPrivilegeReq.builder().roleName(role).
                       privilege("*")
                       .objectName("*")
                       .objectType("Collection").build()
               );

But when trying to create collection using above role privileges getting permission denied to user to create collection in default db. below is the describe role output:test_role description DescribeRoleResp(grantInfos=[DescribeRoleResp.GrantInfo(objectType=Collection, privilege=*, objectName=*, dbName=default, grantor=root)])

I'm a little confused here. V1 API should be deprecated soon.
Why do we just focus on using V2 APi instead? Don't recommend to mix use V1 and V2 API

[shaiktas]

thanks @xiaofan-luan , we have workflow with set off cluster which are in v2.5.x and lesser version v2.4.x as well, This workflow will create users, and grant privileges up on selected cluster which can be either v2.5.x or lesser version. hence we want to use both version API's grantPrivilegeV2 and grantPrivilege. Looks grantPrivilegeV2 is not compatible with v2.4.x cluster's. Kindly suggest the best and long fixable solution here?

[xiaofan-luan]

The V1 API has some major drawbacks and you will need grant access with different object. You have to implement a translation layer between V1 and V2 APIs .

here is how you can grant create collection access under default database.

java
import io.milvus.param.GrantRolePrivilegeParam;

R response = client.grantRolePrivilege(GrantRolePrivilegeParam.newBuilder()
.withDatabaseName("default")
.withRoleName(roleName)
.withObject("Collection")
.withObjectName("*")
.withPrivilege("CreateCollection")
.build());

[yhmo]

The grantPrivilege V1 doesn't have the ability to specify db name. You can use client.useDatabase("xxx") to switch the database and then call the grantPrivilege V1 interface.

Note: not all the interface can specify dbname, depends on the difinition of milvus-proto file
For example, the OperatePrivilegeRequest doesn't have a "db_name" member: https://github.com/milvus-io/milvus-proto/blob/20f3b3d3e030bbcefcaac96d7e5710e92d201e3d/proto/milvus.proto#L1708
The OperatePrivilegeRequestV2 has a "db_name" member so that it can specify database name: https://github.com/milvus-io/milvus-proto/blob/20f3b3d3e030bbcefcaac96d7e5710e92d201e3d/proto/milvus.proto#L1740