From: Tom Lane <tgl@sss.pgh.pa.us>
To: postgresql_tdba@ldbv.bayern.de
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18725: "set role" requires "grant connect on database"
In-reply-to: <18725-9fd2f5084a8129ad@postgresql.org>
References: <18725-9fd2f5084a8129ad@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Wed, 27 Nov 2024 15:42:36 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-ID: <1895476.1732731060.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 27 Nov 2024 13:11:00 -0500
Message-ID: <1895477.1732731060@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1895477.1732731060%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> After minor release update to version 16.5 or 16.6 "set role" to role
> without "grant connect on database" generates error:

> "ERROR:  Benutzer hat das CONNECT-Privileg nicht.keine Berechtigung f=C3=
=BCr
> Datenbank =C2=BB...=C2=AB =

> FEHLER:  keine Berechtigung f=C3=BCr Datenbank =C2=BB...=C2=AB
> SQL state: 42501
> Detail: Benutzer hat das CONNECT-Privileg nicht.
> Context: paralleler Arbeitsprozess"

This bug report is not actionable, because you didn't show what
you did to provoke the error.  I did a little bit of testing
by guessing what you might be talking about, and I don't see
a problem:

regression=3D# create role r;
CREATE ROLE
regression=3D# create database d;
CREATE DATABASE
regression=3D# revoke connect on database d from public;
REVOKE
regression=3D# \c d
You are now connected to database "d" as user "postgres".
d=3D# set role r;                -- should work, and does
SET
d=3D> reset role;
RESET
d=3D# create user joe;
CREATE ROLE
d=3D# grant r to joe;
GRANT ROLE
d=3D# alter user joe set role =3D r;
ALTER ROLE
d=3D# \c d joe                   -- should fail, and does
connection to server on socket "/tmp/.s.PGSQL.5432" failed: FATAL:  permis=
sion denied for database "d"
DETAIL:  User does not have CONNECT privilege.
Previous connection kept
d=3D# grant connect on database d to joe;
GRANT
d=3D# \c d joe                   -- now it should work, and does
You are now connected to database "d" as user "joe".
d=3D> show role;
 role =

------
 r
(1 row)

Please provide a self-contained script that reproduces
your problem.

			regards, tom lane