Message-ID: <b9ae240ad537f9a2088c022bb9a34ff33a1058e1.camel@cybertec.at>
Subject: Re: role to access all information_schema.*?
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Ruben Laguna <ruben.laguna@gmail.com>, pgsql-admin@lists.postgresql.org
Date: Tue, 07 Oct 2025 15:33:32 +0200
In-Reply-To: 
 <CAFOAOWJNJKLr8-YS7Q5wYnUHTjjaTbU6=rmTF_jW5W8fNfFamA@mail.gmail.com>
References: 
	<CAFOAOWJNJKLr8-YS7Q5wYnUHTjjaTbU6=rmTF_jW5W8fNfFamA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-2.fc42) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/b9ae240ad537f9a2088c022bb9a34ff33a1058e1.camel%40cybertec.at>
Precedence: bulk

On Tue, 2025-10-07 at 15:24 +0200, Ruben Laguna wrote:
>=20
> From what I see a user can only see in `select * from information_schema.=
tables`
> the tables that the user has been granted SELECT privilege.=C2=A0
>=20
> So, my question is:=C2=A0 Is=C2=A0 there is some other way to get a user =
to be a
> "metadata viewer"=C2=A0 without been a user that also has access to the d=
ata in
> those tables?=C2=A0
>=20
> Do you know if there is any plan to add such a role? Has it been discuss
> before and deemed a bad idea?

That is not for PostgreSQL to decide.

The information_schema is specified by the SQL standard, and the standard
decrees that you can only see the metadata of objects on which you have
access privileges.

This is quite different from the PostgreSQL approach, which is to make
all metadata public (with the exception of password hashes etc.).

> My use case is to have OpenMetadata to read the information_schema.* and
> publish the table name, column names, etc in the OM user interface.
> I would prefer keeping the privileges of the OM user to a minimum but it
> seems that right now the minimum would be `pg_read_all_data`

You should use the PostgreSQL catalog tables like pg_class and pg_attribute=
.
They are more cumbersome to use, and they may change from version to versio=
n,
but at least everybody can see all their data.

Yours,
Laurenz Albe