Hello Tomasz,

> I'd be very grateful if someone could repeat the scenario described
> below and confirm I'm not daydreaming (should take about 1 minute). I've
> tested it on FB 2.5.0.26074 CS (Linux 32 and 64 bit).
>
> According to
>
> http://www.firebirdsql.org/refdocs/langrefupd25-security-sql-user-mgmt.html
>
> any user with RDB$ADMIN role in the security database and at least one
> other database should be able to create/alter/drop other users.
> If so, in my opinion the following scenario should complete without
> errors (creating a new database is not relevant, but I included it to
> make sure we start from a clean setup).
>
> 1. Run isql as SYSDBA and execute:
> create database 'test.fdb';
>
> 2. Close isql, run it again and connect to test.fdb as sysdba (e.g. isql
> -user sysdba -password topsecret test.fdb) and execute:
> create user U1 password '1';
> commit;
> alter user U1 grant admin role;
> commit;
> grant RDB$ADMIN to U1;
> commit;
>
> 3. Close isql. At this point, we have a user U1, who satisfies the
> requirements from the manual mentioned above. So, run isql again,
> connecting as the new user:
> isql -user U1 -password 1 -role 'RDB$ADMIN' test.fdb
> and execute:
> create user U2 password '1';
> commit;
> alter user U2 password '2';
> commit;
>
> The last alter user statement fails with message
>
> Statement failed, SQLSTATE = HY000
> record not found for user: U2
>
> However, the create user works fine (gsec shows, that U2 had been
> created). Any subsequent attempts to change U1 fail, though.
> Is there anything I'm missing? Should I somehow tell Firebird that, when
> connecting as U1, I'd like to assume admin role not only in test.fdb,
> but also in the security database?
>
> Any help appreciated.

The following works fine for me with Firebird 2.5.2 RC1 64-bit on
Windows 7 Prof.

C:\Firebird\Firebird_252_3051\bin>isql
Use CONNECT or CREATE DATABASE to specify a database
SQL> connect localhost/3051:fbsmptest_1.fdb user sysdba password masterkey;
Database: localhost/3051:fbsmptest_1.fdb, User: sysdba
SQL> create user utest password 'utest' grant admin role;
SQL> commit;
SQL> grant rdb$admin to utest;
SQL> commit;
SQL> connect localhost/3051:fbsmptest_1.fdb user utest password utest
role RDB$ADMIN;
Database: localhost/3051:fbsmptest_1.fdb, User: utest, Role: RDB$ADMIN
SQL> create user utest2 password 'utest2';
SQL> commit;
SQL> alter user utest2 password 'utest3';
SQL> commit;
SQL> connect localhost/3051:fbsmptest_1.fdb user utest2 password utest3;
Database: localhost/3051:fbsmptest_1.fdb, User: utest2
SQL>


Perhaps it might be related to CORE-3398, but I'm not sure. Any chance
to give 2.5.1 or 2.5.2 RC1 a try?


--
With regards,
Thomas Steinmaurer
http://www.upscene.com/