From: Stephen Frost <sfrost@snowman.net>
To: Michael.Dietrich@swisscom.com
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Connect to db denied for superuser inherited by group
Date: Fri, 16 Mar 2018 09:42:34 -0400
Message-ID: <20180316134234.GE2416@tamriel.snowman.net> (raw)
In-Reply-To: <9cd041b2b19143758e4f4d8a752421c5@swisscom.com>
References: <b93d9993e79545ffaa54d440a6f4383f@swisscom.com>
<9cd041b2b19143758e4f4d8a752421c5@swisscom.com>
Greetings,
* Michael.Dietrich@swisscom.com (Michael.Dietrich@swisscom.com) wrote:
> Unexpected behavior when trying to connect to a database. Facts:
> 1) The privilege to connect to the database was revoked from public.
> 2) User without superuser privileges uses a role with superuser rights (usage confirmed with SHOW current_role.)
Please provide more details about what this step #2 actually means.
> 3) Unecpected Message: FATAL: permission denied for database "db" DETAIL: User does not have CONNECT privilege.
Details about exactly what you're doing to connect here would be
helpful.
> After granting one of the listed privileges it is working as expected.
> 1) granting superuser to user
> 2) granting connect to db for user
> 3) granting connect to db to group
> 3) granting connect to db to public
>
> What am I missing? --Michael
CONNECT privileges are needed to be able to connect to the database, so
it's not surprising that you needed to GRANT them to the user after
REVOKE'ing them from PUBLIC. What's not clear is what you're actually
trying to do and what you're expecting to work that apparently isn't.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, Michael.Dietrich@swisscom.com, pgsql-admin@lists.postgresql.org
Subject: Re: Connect to db denied for superuser inherited by group
In-Reply-To: <20180316134234.GE2416@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox