Embedded-Debezium spring boot postgreSQL DB connectivity issue - postgresql

Question

I tried connecting postgreSQL with spring boot and embedded debezium, the DB connection is getting established, after the table is locked i get access denied. I am logging in with replication access. Kindly find the below logs.
2020-09-15 20:27:00.806 INFO 14784 --- [pool-3-thread-1] i.d.c.postgresql.PostgresConnectorTask : user 'loginUser' connected to database 'pgDatabase' on PostgreSQL 12.1 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-39), 64-bit with roles:
role 'loginUser' [superuser: false, replication: true, inherit: true, create role: false, create db: false, can log in: true]
2020-09-15 20:27:00.813 INFO 14784 --- [pool-3-thread-1] i.d.c.p.connection.PostgresConnection : Obtained valid replication slot ReplicationSlot [active=false, latestFlushedLsn=null, catalogXmin=null]
2020-09-15 20:27:00.813 INFO 14784 --- [pool-3-thread-1] i.d.c.postgresql.PostgresConnectorTask : Found previous offset PostgresOffsetContext [sourceInfoSchema=Schema{io.debezium.connector.postgresql.Source:STRUCT}, sourceInfo=source_info[server='pgServer.com-pgDatabase'db='pgDatabase', lsn=LSN{2/61010900}, txId=14082, timestamp=2020-09-10T01:04:03.660Z, snapshot=FALSE], partition={server=pgServer.com-pgDatabase}, lastSnapshotRecord=true, lastCompletelyProcessedLsn=null, lastCommitLsn=null, transactionContext=TransactionContext [currentTransactionId=null, perTableEventCount={}, totalEventCount=0]]
2020-09-15 20:27:00.814 INFO 14784 --- [pool-3-thread-1] i.d.c.p.snapshot.InitialSnapshotter : Previous snapshot has completed successfully, streaming logical changes from last known position
2020-09-15 20:27:00.871 DEBUG 14784 --- [ main] .m.m.a.ExceptionHandlerExceptionResolver : ControllerAdvice beans: 0 #ExceptionHandler, 1 ResponseBodyAdvice
2020-09-15 20:27:08.185 INFO 14784 --- [pool-3-thread-1] i.d.c.p.c.PostgresReplicationConnection : Initializing PgOutput logical decoder publication
2020-09-15 20:27:08.243 INFO 14784 --- [pool-3-thread-1] i.d.c.p.c.PostgresReplicationConnection : Creating new publication 'dbz_publication' for plugin 'PGOUTPUT'
2020-09-15 20:27:08.246 INFO 14784 --- [pool-3-thread-1] i.d.c.p.c.PostgresReplicationConnection : Creating Publication with statement 'CREATE PUBLICATION dbz_publication FOR ALL TABLES;'
2020-09-15 20:27:08.765 INFO 14784 --- [pool-3-thread-1] o.a.k.c.storage.FileOffsetBackingStore : Stopped FileOffsetBackingStore
2020-09-15 20:27:09.059 ERROR 14784 --- [pool-3-thread-1] io.debezium.embedded.EmbeddedEngine : Unable to initialize and start connector's task class 'io.debezium.connector.postgresql.PostgresConnectorTask' with config: {connector.class=io.debezium.connector.postgresql.PostgresConnector, database.user=loginUser, database.dbname=pgDatabase, offset.storage=org.apache.kafka.connect.storage.FileOffsetBackingStore, database.server.name=pgServer.com-pgDatabase, database.port=5432, plugin.name=pgoutput, table.whitelist=schema.tableName, offset.flush.interval.ms=10000, offset.storage.file.filename=/Users/loginUser/student-offset.dat, database.hostname=pgServer.com, database.password=********, name=student-postgres-connector}
io.debezium.jdbc.JdbcConnectionException: ERROR: permission denied for database pgDatabase

Answer 1

Please check permissions of your role loginUser:
Setting up a PostgreSQL server to run a Debezium connector requires a database user who can perform replications. Replication can be performed only by a database user who has appropriate permissions and only for a configured number of hosts.

Answer 2

From my experience one needs (with pgoutput plugin starting from v10.x):
Enable logical replication on DB instance;
User belonging to REPLICATION (or rds_replication for AWS RDS - server-less options seems to be broken for years) role;
Be owner (the user connecting to DB) of all white-listed tables;
Have USE, SELECT on all white-listed tables and sequences;
Have access for USE, SELECT on "public" schema (meta data);
Have permissions to create objects on "public" schema.
Note: the requirement to have rds_admin is not a requirement but simple way to get started if the list above is overhwhelming.