From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: Why do i need to install set_user extension if i can directly grant all required privileges to user?
Date: Wed, 21 Jun 2023 16:06:11 +0200
Message-ID: <44912597-d81a-aece-2222-5a2e116dc0e1@jakobs.com> (raw)
In-Reply-To: <310498031.1194425.1687354401566@office.mailbox.org>
References: <CAF57e9Mg7yBnt6UdaLQDYbqouiD+e7gn7mdWrBMuB4n82V1yhQ@mail.gmail.com>
<310498031.1194425.1687354401566@office.mailbox.org>
Am 21.06.23 um 15:33 schrieb Erik Wienhold:
>
> Changing roles is already possible in Postgres. You must be a member of the
> target role or be a superuser in order to change roles.
This is going to change in detail as of version 16 of PostgreSQL. You
may determine whether a role switch is allowed or not.
Excerpt from https://www.postgresql.org/docs/16/sql-grant.html:
"The |SET| option, if it is set to |TRUE|, allows the member to change
to the granted role using the |SET ROLE|
<https://www.postgresql.org/docs/16/sql-set-role.html; command. If a
role is an indirect member of another role, it can use |SET ROLE| to
change to that role only if there is a chain of grants each of which has
|SET TRUE|. This option defaults to |TRUE|."
--
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012
Attachments:
[application/pgp-signature] OpenPGP_signature (202B, ../44912597-d81a-aece-2222-5a2e116dc0e1@jakobs.com/3-OpenPGP_signature)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: holger@jakobs.com, pgsql-admin@lists.postgresql.org
Subject: Re: Why do i need to install set_user extension if i can directly grant all required privileges to user?
In-Reply-To: <44912597-d81a-aece-2222-5a2e116dc0e1@jakobs.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox