From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael.Dietrich@swisscom.com
Cc: sfrost@snowman.net
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: AW: Connect to db denied for superuser inherited by group
Date: Tue, 20 Mar 2018 10:11:41 -0400
Message-ID: <10823.1521555101@sss.pgh.pa.us> (raw)
In-Reply-To: <214530c2d4cb438ca204bd2a3b5b4747@swisscom.com>
References: <b93d9993e79545ffaa54d440a6f4383f@swisscom.com>
<9cd041b2b19143758e4f4d8a752421c5@swisscom.com>
<20180316134234.GE2416@tamriel.snowman.net>
<214530c2d4cb438ca204bd2a3b5b4747@swisscom.com>
<Michael.Dietrich@swisscom.com> writes:
> What I've done
> CREATE ROLE superrole WITH NOLOGIN SUPERUSER ..;
> CREATE USER nosuperuser WITH LOGIN NOSUPERUSER INHERIT ..;
> GRANT superrole TO nosuperuser WITH ADMIN OPTION;
> REVOKE CONNECT ON DATABASE nonpublicdb FROM public ;
> psql -d postgres -U nosupuser
> postgres=# set role superrole;
> postgres=# \c nonpublicdb
> FATAL: permission denied for database " nonpublicdb "
> DETAIL: User does not have CONNECT privilege.
> I expect that the connection to the database is allowed since a role
> with superuser is used.
You're misunderstanding what psql's \c command does. In this form,
it attempts a connection with the new database name, but the same
username as the previous connection, ie nosupuser. It doesn't know
anything about SET ROLE commands you may have issued to the server
while connected.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, Michael.Dietrich@swisscom.com, sfrost@snowman.net, pgsql-admin@lists.postgresql.org
Subject: Re: AW: Connect to db denied for superuser inherited by group
In-Reply-To: <10823.1521555101@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox