Feedback-ID: i76984098:Fastmail
Message-ID: <076fe1a7-b72c-4ba1-8589-cd7ece3fd982@aklaver.com>
Date: Wed, 11 Sep 2024 08:09:13 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Backward compat issue with v16 around ROLEs
To: Dominique Devienne <ddevienne@gmail.com>,
 pgsql-general@lists.postgresql.org
References: <CAFCRh-8+PGGTuqg=rSKA533D0dqYAgq69UzSqMm67VEW02nZyQ@mail.gmail.com>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <CAFCRh-8+PGGTuqg=rSKA533D0dqYAgq69UzSqMm67VEW02nZyQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/076fe1a7-b72c-4ba1-8589-cd7ece3fd982%40aklaver.com>
Precedence: bulk

On 9/11/24 07:41, Dominique Devienne wrote:
> Hi. I'm going around in circles trying to solve an issue with our

> on v16:
> 
> D:\pdgm\trunk\psc2>psql service=pau16
> psql (17beta3, server 16.1)
> Type "help" for help.
> 
> ddevienne=> create role dd_owner createrole;
> CREATE ROLE
> ddevienne=> create role dd_admin noinherit;
> CREATE ROLE
> ddevienne=> grant dd_owner to dd_admin;
> GRANT ROLE
> ddevienne=> set role dd_owner;
> ERROR:  permission denied to set role "dd_owner"
> ddevienne=> grant dd_owner to current_user;
> GRANT ROLE
> ddevienne=> set role dd_owner;
> SET
> ddevienne=> create role dd_user;
> CREATE ROLE
> ddevienne=> grant dd_admin to dd_user;
> ERROR:  permission denied to grant role "dd_admin"
> DETAIL:  Only roles with the ADMIN option on role "dd_admin" may grant
> this role.
> ddevienne=>
> 
> 

What user did you do the above as?

On my Postgres 16.4 instance logged in as postgres:

test=# create role dd_owner createrole;
CREATE ROLE
test=# create role dd_admin noinherit;
CREATE ROLE
test=# grant dd_owner to dd_admin;
GRANT ROLE
test=# set role dd_owner;
SET
test=> grant dd_owner to current_user;
ERROR:  permission denied to grant role "dd_owner"
DETAIL:  Only roles with the ADMIN option on role "dd_owner" may grant 
this role.
test=> create role dd_user;
CREATE ROLE
test=> grant dd_admin to dd_user;
ERROR:  permission denied to grant role "dd_admin"
DETAIL:  Only roles with the ADMIN option on role "dd_admin" may grant 
this role.

-- 
Adrian Klaver
adrian.klaver@aklaver.com