Message-ID: <44912597-d81a-aece-2222-5a2e116dc0e1@jakobs.com>
Date: Wed, 21 Jun 2023 16:06:11 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Content-Language: de-DE
To: pgsql-admin@lists.postgresql.org
References: 
 <CAF57e9Mg7yBnt6UdaLQDYbqouiD+e7gn7mdWrBMuB4n82V1yhQ@mail.gmail.com>
 <310498031.1194425.1687354401566@office.mailbox.org>
From: Holger Jakobs <holger@jakobs.com>
Subject: Re: Why do i need to install set_user extension if i can directly
 grant all required privileges to user?
In-Reply-To: <310498031.1194425.1687354401566@office.mailbox.org>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------lohKO5zmQeoRoqYpjOSCeS25"
Archived-At: 
 <https://www.postgresql.org/message-id/44912597-d81a-aece-2222-5a2e116dc0e1%40jakobs.com>
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------lohKO5zmQeoRoqYpjOSCeS25
Content-Type: multipart/mixed; boundary="------------tCPy3KBCLsybT06nQpYHOheo";
 protected-headers="v1"
From: Holger Jakobs <holger@jakobs.com>
To: pgsql-admin@lists.postgresql.org
Message-ID: <44912597-d81a-aece-2222-5a2e116dc0e1@jakobs.com>
Subject: Re: Why do i need to install set_user extension if i can directly
 grant all required privileges to user?
References: <CAF57e9Mg7yBnt6UdaLQDYbqouiD+e7gn7mdWrBMuB4n82V1yhQ@mail.gmail.com>
 <310498031.1194425.1687354401566@office.mailbox.org>
In-Reply-To: <310498031.1194425.1687354401566@office.mailbox.org>

--------------tCPy3KBCLsybT06nQpYHOheo
Content-Type: multipart/alternative;
 boundary="------------MnjEzaoARc3Xdfq3X20cNhw5"

--------------MnjEzaoARc3Xdfq3X20cNhw5
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

QW0gMjEuMDYuMjMgdW0gMTU6MzMgc2NocmllYiBFcmlrIFdpZW5ob2xkOg0KPg0KPiBDaGFu
Z2luZyByb2xlcyBpcyBhbHJlYWR5IHBvc3NpYmxlIGluIFBvc3RncmVzLiAgWW91IG11c3Qg
YmUgYSBtZW1iZXIgb2YgdGhlDQo+IHRhcmdldCByb2xlIG9yIGJlIGEgc3VwZXJ1c2VyIGlu
IG9yZGVyIHRvIGNoYW5nZSByb2xlcy4NCg0KVGhpcyBpcyBnb2luZyB0byBjaGFuZ2UgaW4g
ZGV0YWlsIGFzIG9mIHZlcnNpb24gMTYgb2YgUG9zdGdyZVNRTC4gWW91IA0KbWF5IGRldGVy
bWluZSB3aGV0aGVyIGEgcm9sZSBzd2l0Y2ggaXMgYWxsb3dlZCBvciBub3QuDQoNCkV4Y2Vy
cHQgZnJvbSBodHRwczovL3d3dy5wb3N0Z3Jlc3FsLm9yZy9kb2NzLzE2L3NxbC1ncmFudC5o
dG1sOg0KDQoiVGhlIHxTRVR8IG9wdGlvbiwgaWYgaXQgaXMgc2V0IHRvIHxUUlVFfCwgYWxs
b3dzIHRoZSBtZW1iZXIgdG8gY2hhbmdlIA0KdG8gdGhlIGdyYW50ZWQgcm9sZSB1c2luZyB0
aGUgfFNFVCBST0xFfCANCjxodHRwczovL3d3dy5wb3N0Z3Jlc3FsLm9yZy9kb2NzLzE2L3Nx
bC1zZXQtcm9sZS5odG1sPiBjb21tYW5kLiBJZiBhIA0Kcm9sZSBpcyBhbiBpbmRpcmVjdCBt
ZW1iZXIgb2YgYW5vdGhlciByb2xlLCBpdCBjYW4gdXNlIHxTRVQgUk9MRXwgdG8gDQpjaGFu
Z2UgdG8gdGhhdCByb2xlIG9ubHkgaWYgdGhlcmUgaXMgYSBjaGFpbiBvZiBncmFudHMgZWFj
aCBvZiB3aGljaCBoYXMgDQp8U0VUIFRSVUV8LiBUaGlzIG9wdGlvbiBkZWZhdWx0cyB0byB8
VFJVRXwuIg0KDQoNCg0KLS0gDQpIb2xnZXIgSmFrb2JzLCBCZXJnaXNjaCBHbGFkYmFjaCwg
VGVsLiArNDktMTc4LTk3NTkwMTINCg0K
--------------MnjEzaoARc3Xdfq3X20cNhw5
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body>
    <div class=3D"moz-cite-prefix">Am 21.06.23 um 15:33 schrieb Erik
      Wienhold:<br>
    </div>
    <blockquote type=3D"cite"
      cite=3D"mid:310498031.1194425.1687354401566@office.mailbox.org"><br=
>
      <pre class=3D"moz-quote-pre" wrap=3D"">Changing roles is already po=
ssible in Postgres.  You must be a member of the
target role or be a superuser in order to change roles. </pre>
    </blockquote>
    <p>This is going to change in detail as of version 16 of PostgreSQL.
      You may determine whether a role switch is allowed or not.</p>
    <p>Excerpt from <a class=3D"moz-txt-link-freetext" href=3D"https://ww=
w.postgresql.org/docs/16/sql-grant.html">https://www.postgresql.org/docs/=
16/sql-grant.html</a>:<br>
    </p>
    <p>"The <code class=3D"literal">SET</code> option, if it is set to <c=
ode
        class=3D"literal">TRUE</code>, allows the member to change to the=

      granted role using the <a class=3D"link"
        href=3D"https://www.postgresql.org/docs/16/sql-set-role.html"
        title=3D"SET ROLE"><code class=3D"command">SET ROLE</code></a>
      command. If a role is an indirect member of another role, it can
      use <code class=3D"literal">SET ROLE</code> to change to that role
      only if there is a chain of grants each of which has <code
        class=3D"literal">SET TRUE</code>. This option defaults to <code
        class=3D"literal">TRUE</code>."</p>
    <p><br>
    </p>
    <br>
    <pre class=3D"moz-signature" cols=3D"72">--=20
Holger Jakobs, Bergisch Gladbach, Tel. +49-178-9759012</pre>
  </body>
</html>

--------------MnjEzaoARc3Xdfq3X20cNhw5--

--------------tCPy3KBCLsybT06nQpYHOheo--

--------------lohKO5zmQeoRoqYpjOSCeS25
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

wmMEABEIACMWIQScuJCxWJK1p5BOebGKV5yTsxlhugUCZJMD0wUDAAAAAAAKCRCKV5yTsxlhuoz4
AKCmv4Fw6ldNbeDj8iRSaIp680bkHACgv6ql6Wpq2dhXvbwK0Be1OP/rfwk=
=qNjy
-----END PGP SIGNATURE-----

--------------lohKO5zmQeoRoqYpjOSCeS25--