pg.ddx.io pgsql-admin@postgresql.org mailing list archivehelp / color / mirror / Atom feed
privilege inheritance to a login role through a group role 2+ messages / 2 participants [nested] [flat]
* privilege inheritance to a login role through a group role @ 2009-03-31 23:33 Kasia Tuszynska <ktuszynska@esri.com> 0 siblings, 1 reply; 2+ messages in thread From: Kasia Tuszynska @ 2009-03-31 23:33 UTC (permalink / raw) To: 'pgsql-admin@postgresql.org' <'pgsql-admin@postgresql.org'> Hello Everyone. I am having issues with privilege inheritance to a login role through a group role. These are the steps I am performing: 1. data: stcities belongs to user gdb, it resides in the gdb schema 2. map user is a login role: CREATE ROLE map LOGIN ENCRYPTED PASSWORD 'md59ec9dda576db2a36c42c1c3af155d07c' NOSUPERUSER NOINHERIT CREATEDB NOCREATEROLE; 1. editor role is created, and privileges to the data are granted to it: CREATE ROLE editor NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE; GRANT select on gdb.stcities TO editor; 1. user map is made a member of the editor role: GRANT editor TO map; Now, theoretically, I am expecting the map role to be able to inherit the select privileges via the editor group role to the gdb.stcities data. But that is not the case, when I make a connection to pgAdminIII as the map user, I receive the following message: An error has occurred: Error: permission denied for relation stcities So, map is not inheriting the privs from the role. -editor group has privs on the data: gdb=arwdxt/gdb,editor=r/gdb -Selecting from pg_auth_members tells me that role map is part of group editor So, why is map not inheriting the privs granted to the editor role? Am I missing a step? Thanks in advance, Sincerely, Kasia ^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: privilege inheritance to a login role through a group role @ 2009-03-31 23:39 Tom Lane <tgl@sss.pgh.pa.us> parent: Kasia Tuszynska <ktuszynska@esri.com> 0 siblings, 0 replies; 2+ messages in thread From: Tom Lane @ 2009-03-31 23:39 UTC (permalink / raw) To: Kasia Tuszynska <ktuszynska@esri.com>; +Cc: pgsql-admin Kasia Tuszynska <ktuszynska@esri.com> writes: > I am having issues with privilege inheritance to a login role through a group role. > These are the steps I am performing: > 1. data: stcities belongs to user gdb, it resides in the gdb schema > 2. map user is a login role: > CREATE ROLE map LOGIN > ENCRYPTED PASSWORD 'md59ec9dda576db2a36c42c1c3af155d07c' > NOSUPERUSER NOINHERIT CREATEDB NOCREATEROLE; > 1. editor role is created, and privileges to the data are granted to it: > CREATE ROLE editor NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE; > GRANT select on gdb.stcities TO editor; > 1. user map is made a member of the editor role: > GRANT editor TO map; > Now, theoretically, I am expecting the map role to be able to inherit the select privileges via the editor group role to the gdb.stcities data. You've got the INHERIT bit backwards: you'd have to apply INHERIT to map, not editor, to have editor's privileges automatically work for map. If there's some identifiable bit of the documentation that confused you about this, please point it out so we can improve it. regards, tom lane ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2009-03-31 23:39 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2009-03-31 23:33 privilege inheritance to a login role through a group role Kasia Tuszynska <ktuszynska@esri.com> 2009-03-31 23:39 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox