mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 07:40:28 +08:00
26 lines
1.3 KiB
PL/PgSQL
26 lines
1.3 KiB
PL/PgSQL
CREATE OR REPLACE PROCEDURE teleport_deactivate_user(username varchar)
|
|
LANGUAGE plpgsql
|
|
AS $$
|
|
DECLARE
|
|
rec record;
|
|
BEGIN
|
|
-- Only deactivate if the user doesn't have other active sessions.
|
|
-- Update to pg_stat_activity is delayed for a few hundred ms. Use
|
|
-- stv_sessions instead:
|
|
-- https://docs.aws.amazon.com/redshift/latest/dg/r_STV_SESSIONS.html
|
|
IF EXISTS (SELECT user_name FROM stv_sessions WHERE user_name = CONCAT('IAM:', username)) THEN
|
|
RAISE EXCEPTION 'TP000: User has active connections';
|
|
ELSE
|
|
-- Disable ability to login for the user.
|
|
-- We do this before revoking roles so that the pg_shadow table
|
|
-- (oid 1260) lock is acquired before the pg_role (oid 4775) and
|
|
-- pg_identity (oid 4771) table locks, so that the locks are acquired in
|
|
-- the same order in the activate/deactivate/delete procedures.
|
|
EXECUTE 'ALTER USER ' || QUOTE_IDENT(username) || ' WITH CONNECTION LIMIT 0';
|
|
-- Revoke all role memberships except teleport-auto-user.
|
|
FOR rec IN select role_name FROM svv_user_grants WHERE user_name = username AND admin_option = false AND role_name != 'teleport-auto-user' LOOP
|
|
EXECUTE 'REVOKE ROLE ' || QUOTE_IDENT(rec.role_name) || ' FROM ' || QUOTE_IDENT(username);
|
|
END LOOP;
|
|
END IF;
|
|
END;$$;
|