Feedback-ID: i76984098:Fastmail
Message-ID: <42db74b1-69a7-452b-9e27-d9d421aae8db@aklaver.com>
Date: Wed, 22 May 2024 07:48:04 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: search_path and SET ROLE
To: Ron Johnson <ronljohnsonjr@gmail.com>,
 pgsql-general <pgsql-general@postgresql.org>
References: <CANzqJaBoAkdXMkPvdXqhkBduLqpTbU7BdjyZePcuWkFnKi1SDQ@mail.gmail.com>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <CANzqJaBoAkdXMkPvdXqhkBduLqpTbU7BdjyZePcuWkFnKi1SDQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/42db74b1-69a7-452b-9e27-d9d421aae8db%40aklaver.com>
Precedence: bulk

On 5/22/24 07:27, Ron Johnson wrote:
> PG 9.6.24 (Soon, I swear!)
> 
> It seems that the search_path of the role that you SET ROLE to does not 
> become the new search_path.
> 
> Am I missing something, or is that PG's behavior?
> 
> AS USER postgres
> ================
> 
> $ psql -h 10.143.170.52 -Xac "CREATE ROLE dbagrp SUPERUSER INHERIT NOLOGIN;"
> CREATE ROLE dbagrp SUPERUSER INHERIT NOLOGIN;
> CREATE ROLE
> 
> $ psql -h 10.143.170.52 -Xac "CREATE USER rjohnson IN GROUP dbagrp INHERIT;"
> CREATE USER rjohnson IN GROUP dbagrp INHERIT;
> CREATE ROLE
> 
> [postgres@FISPMONDB001 ~]$ psql -h 10.143.170.52 -Xac "CREATE USER 
> \"11026270\" IN GROUP dbagrp INHERIT PASSWORD '${NewPass}' VALID UNTIL 
> '2024-06-30 23:59:59';"
> CREATE USER "11026270" IN GROUP dbagrp INHERIT PASSWORD 'linenoise' 
> VALID UNTIL '2024-06-30 23:59:59';
> CREATE ROLE
> 
> $ psql -h 10.143.170.52 -Xac "ALTER ROLE dbagrp set search_path = 
> dbagrp, public, dba, cds, tms;"
> ALTER ROLE dbagrp set search_path = dbagrp, public, dba, cds, tms;
> ALTER ROLE
> 
> AS USER rjohnson
> ================
> 
> [rjohnson@fpslbxcdsdbppg1 ~]$ psql -dCDSLBXW
> psql (9.6.24)
> Type "help" for help.
> 
> CDSLBXW=> SET ROLE dbagrp;
> SET
> CDSLBXW=#
> CDSLBXW=# SHOW SEARCH_PATH;
>     search_path
> -----------------
>   "$user", public
> (1 row)
> 
> 
> Back to user postgres
> =================
> 
> $ psql -h 10.143.170.52 -Xac "ALTER ROLE rjohnson set search_path = 
> dbagrp, public, dba, cds, tms;"
> ALTER ROLE rjohnson set search_path = dbagrp, public, dba, cds, tms;
> ALTER ROLE
> 
> Back to user rjohnson
> =================
> 
> [rjohnson@fpslbxcdsdbppg1 ~]$ psql -dCDSLBXW
> psql (9.6.24)
> Type "help" for help.
> 
> CDSLBXW=>
> CDSLBXW=> SET ROLE dbagrp;
> SET
> 
> CDSLBXW=# SHOW SEARCH_PATH;
>            search_path
> -------------------------------
>   dbagrp, public, dba, cds, tms
> (1 row)


https://www.postgresql.org/docs/current/sql-alterrole.html


Whenever the role subsequently starts a new session, the specified value 
becomes the session default, overriding whatever setting is present in 
postgresql.conf or has been received from the postgres command line. 
This only happens at login time; executing SET ROLE or SET SESSION 
AUTHORIZATION does not cause new configuration values to be set. 
Settings set for all databases are overridden by database-specific 
settings attached to a role. Settings for specific databases or specific 
roles override settings for all roles.

-- 
Adrian Klaver
adrian.klaver@aklaver.com