From: PG Doc comments form <noreply@postgresql.org>
To: pgsql-docs@lists.postgresql.org
Cc: shen@oneshen.com
Subject: CREATEROLE Inheritance
Date: Tue, 18 Jul 2023 13:21:35 +0000
Message-ID: <168968649532.632.17678694767510635173@wrigleys.postgresql.org> (raw)
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/15/role-membership.html
Description:
Regarding this paragraph: "The role attributes LOGIN, SUPERUSER, CREATEDB,
and CREATEROLE can be thought of as special privileges, but they are never
inherited as ordinary privileges on database objects are. You must actually
SET ROLE to a specific role having one of these attributes in order to make
use of the attribute. Continuing the above example, we might choose to grant
CREATEDB and CREATEROLE to the admin role. Then a session connecting as role
joe would not have these privileges immediately, only after doing SET ROLE
admin."
I have checked this for CREATEROLE and this role attribute is definitely
inheritable. I've created a new user with CREATE ROLE and no additional
options. I've tried to create a role and could not. Then I made this user a
member of a role that have the CREATEROLE attribute set to TRUE (with GRANT
user_with_createrole TO new_user). With the same new user I could now create
new roles. This has to mean inheritance works for this attribute.
I am using DataGrip IDE and made sure in the output window that the program
does not issue a 'SET ROLE' command before attempting to create a role. So
creating a new role worked with the new user (by inheritance) without using
'SET ROLE' before.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: noreply@postgresql.org, pgsql-docs@lists.postgresql.org, shen@oneshen.com
Subject: Re: CREATEROLE Inheritance
In-Reply-To: <168968649532.632.17678694767510635173@wrigleys.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox