Date: Wed, 1 Nov 2023 13:09:59 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Jordi =?utf-8?Q?Guti=C3=A9rrez?= Hermoso <jordigh@octave.org>,
	pgsql-docs@lists.postgresql.org
Subject: Re: Document target_role param of ALTER DEFAULT PRIVILEGES
Message-ID: <ZUKGZ4BSL0p3Pn4p@momjian.us>
References: <72652d72e1816bfc3c05d40f9e0e0373d07823c8.camel@octave.org>
 <293903c1f00f9b5053c0aa388ddc2850ae537f33.camel@cybertec.at>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="9IbS4Egp8PUeJ94h"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <293903c1f00f9b5053c0aa388ddc2850ae537f33.camel@cybertec.at>
Archived-At: 
 <https://www.postgresql.org/message-id/ZUKGZ4BSL0p3Pn4p%40momjian.us>
Precedence: bulk


--9IbS4Egp8PUeJ94h
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

On Thu, Feb 18, 2021 at 08:16:13AM +0100, Laurenz Albe wrote:
> On Wed, 2021-02-17 at 15:08 -0500, Jordi Gutiérrez Hermoso wrote:
> > I just had a confusing moment trying to figure out why my roles
> > weren't creating tables the way I was expecting them to. I didn't
> > understand what the `target_role` parameter did. No matter how I try
> > to read this page, I can't see an explanation for that parameter:
> > 
> > https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
> > 
> > I propose an explanation like the following be added to the
> > `target_role` parameter:
> > 
> >     This is the role that will create objects with altered default
> >     privileges. Note that changes in default privileges aren't
> >     inherited, so altering the default privileges of created objects
> >     for a parent role will not change the default privileges of
> >     objects created by inherited roles.
> 
> +1.  I cannot count the number of times I have seen people confused by that.
> 
> Suggested patch attached.

I see how people can be confused.  I wrote this patch, which I think is
simpler than the previously posted one.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Only you can decide what is important to you.

--9IbS4Egp8PUeJ94h
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename="role.diff"

diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgml
index f1d54f5aa3..8a6006188d 100644
--- a/doc/src/sgml/ref/alter_default_privileges.sgml
+++ b/doc/src/sgml/ref/alter_default_privileges.sgml
@@ -137,7 +137,11 @@ REVOKE [ GRANT OPTION FOR ]
     <listitem>
      <para>
       The name of an existing role of which the current role is a member.
-      If <literal>FOR ROLE</literal> is omitted, the current role is assumed.
+      Default access privileges are not inherited, so member roles
+      must use <command>SET ROLE</command> to access these privileges,
+      or <command>ALTER DEFAULT PRIVILEGES</command> must be run for
+      each member role.  If <literal>FOR ROLE</literal> is omitted,
+      the current role is assumed.
      </para>
     </listitem>
    </varlistentry>

--9IbS4Egp8PUeJ94h--