From: Alvaro Herrera <alvherre@2ndquadrant.com>
To: David Johnston <polobo@yahoo.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: How was I able to drop a role even though objects depend on it?
Date: Mon, 1 Jul 2013 13:38:04 -0400
Message-ID: <20130701173803.GI3757@eldon.alvh.no-ip.org> (raw)
In-Reply-To: <1372697164049-5762060.post@n5.nabble.com>
References: <59BF48FAC524384DA413D8F4F2E4BA6907D9A9DA@CINURCNA06.e2k.ad.ge.com>
<1372697164049-5762060.post@n5.nabble.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
David Johnston wrote:
> Wojciechowski, Robert (GE Transportation) wrote
> > [...] there is a database that shows this connect grant to a user that was
> > known as foo1_userA (oid 3562339547): 3562339547=c/postgres
>
> The main user dependent situation is having said user OWNER on a database
> object. Simply giving a user connect privileges on a database does not make
> the database dependent upon said user and so removing said user remains
> possible.
Dropping a user which is either a database owner or has been granted
CONNECT privileges is supposed to be disallowed:
alvherre=# create user f;
CREATE ROLE
alvherre=# create database f owner f;
CREATE DATABASE
alvherre=# drop role f;
ERROR: role "f" cannot be dropped because some objects depend on it
DETALLE: owner of database f
alvherre=# create role g;
CREATE ROLE
alvherre=# grant connect on database f to g;
GRANT
alvherre=# drop role g;
ERROR: role "g" cannot be dropped because some objects depend on it
DETALLE: privileges for database f
We're supposed to have sufficient locking so that concurrent
transactions don't see problems either (one xact drops the user while
the other creates the database), but maybe there are bugs somewhere.
--
Álvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: alvherre@2ndquadrant.com, polobo@yahoo.com
Subject: Re: How was I able to drop a role even though objects depend on it?
In-Reply-To: <20130701173803.GI3757@eldon.alvh.no-ip.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox