From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Andrus" <kobruleht2@hot.ee>
cc: "pgsql-general" <pgsql-general@postgresql.org>
Subject: Re: How to restore roles without changing postgres password
In-reply-to: <38D406CB287140A49F635258B634E072@dell2>
References: <38D406CB287140A49F635258B634E072@dell2>
Comments: In-reply-to "Andrus" <kobruleht2@hot.ee>
	message dated "Wed, 12 Feb 2020 00:26:50 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <11490.1581461180.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 11 Feb 2020 17:46:20 -0500
Message-ID: <11491.1581461180@sss.pgh.pa.us>
Precedence: bulk

"Andrus" <kobruleht2@hot.ee> writes:
> How to create backup script which restores all roles and role membership=
s =

> from other server without changing postgres user password.

[ shrug... ]  Edit the command(s) you don't want out of the script.
This seems like a mighty random requirement to expect pg_dump to
support out-of-the-box.

I wonder though if there's a case for making that easier by breaking
up the output into multiple ALTER commands.  Right now you get
something like

CREATE ROLE postgres;
ALTER ROLE postgres WITH SUPERUSER INHERIT CREATEROLE CREATEDB LOGIN REPLI=
CATION BYPASSRLS PASSWORD 'md5128f0d64bfb424d132c3305b3057281c';

but perhaps we could make it print

CREATE ROLE postgres;
ALTER ROLE postgres WITH SUPERUSER;
ALTER ROLE postgres WITH INHERIT;
ALTER ROLE postgres WITH CREATEROLE;
ALTER ROLE postgres WITH CREATEDB;
ALTER ROLE postgres WITH LOGIN;
ALTER ROLE postgres WITH REPLICATION;
ALTER ROLE postgres WITH BYPASSRLS;
ALTER ROLE postgres WITH PASSWORD 'md5128f0d64bfb424d132c3305b3057281c';

That would make scripted edits a bit easier, and it'd also make the
output a bit more cross-version portable, eg if you try to load the
latter into a version without BYPASSRLS, the rest of the commands
would still work.

			regards, tom lane