Feedback-ID: i0c21471d:Fastmail
MIME-Version: 1.0
Date: Tue, 05 May 2026 15:23:01 -0300
From: "Euler Taveira" <euler@eulerto.com>
To: =?UTF-8?Q?=C3=81lvaro_Rodr=C3=ADguez?= <alvaro@datadoghq.com>,
 pgsql-bugs@lists.postgresql.org
Cc: "Javier Maellas" <javier.maellas@datadoghq.com>,
 "Diego Revenga" <diego.revengagonzalez@datadoghq.com>
Message-Id: <fb3f446c-3a5e-40c0-82da-18ce6b81926b@app.fastmail.com>
In-Reply-To: 
 <CA+C_kKWHMP4c56jx1BPvP1jmjp2pmBu0Cw07fPVECUmkJSnT4w@mail.gmail.com>
References: 
 <CA+C_kKWHMP4c56jx1BPvP1jmjp2pmBu0Cw07fPVECUmkJSnT4w@mail.gmail.com>
Subject: Re: pg_dumpall can't be restored with different bootstrap superuser
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/fb3f446c-3a5e-40c0-82da-18ce6b81926b%40app.fastmail.com>
Precedence: bulk

On Tue, May 5, 2026, at 7:51 AM, =C3=81lvaro Rodr=C3=ADguez wrote:
>
> We have hit an issue with pg_dumpall --roles-only where the role grant=
s=20
> to other roles can't be reapplied in a clean database, if the bootstra=
p=20
> superuser does not have the same name in both databases.
>

This is not a bug. There is no way that pg_dumpall knows that the bootst=
rap
user you want is another one. If you want to share roles and its propert=
ies
between clusters, don't use different bootstrap users. If you do so, you=
 should
execute another step between dump and restore to replace the source boot=
strap
user with the target bootstrap user or even collect the error messages a=
nd
rewrite the affected SQL commands.

I don't think an option to inject arbitrary grantor is acceptable for se=
curity
concerns. There isn't a role specification like BOOTSTRAP_USER (similar =
to
CURRENT_ROLE or SESSION_USER) that would avoid this situation. Maybe we =
should
add a sentence saying that GRANT on roles requires the same bootstrap us=
er.


--=20
Euler Taveira
EDB   https://www.enterprisedb.com/