public inbox for [email protected]  

help / color / mirror / Atom feed

From: Dominique Devienne <[email protected]>
To: Pavel Luzanov <[email protected]>
Cc: Laurenz Albe <[email protected]>
Cc: Karsten Hilbert <[email protected]>
Cc: [email protected]
Subject: Re: Q: GRANT ... WITH ADMIN on PG 17
Date: Mon, 25 Aug 2025 14:38:02 +0200
Message-ID: <CAFCRh--J96OtjyH8ow5bosKy9J7jqQw-gupYhHhP9QTLK-XwaQ@mail.gmail.com> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>
	<[email protected]>

On Mon, Aug 25, 2025 at 2:22 PM Pavel Luzanov <[email protected]> wrote:
>> On 22.08.2025 11:40, Laurenz Albe wrote:
>> Yes, that should work as follows: [...]

> [...] A safer option is to use security definer function to grant membership

FWIW, it's basically what I did.

My primary "admin" application role lost CREATEROLE,
and instead gained EXECUTE on security-definer procs
from a new lower-level role (with CREATEROLE),
in a new separate schema, which does all create/drop
roles or grant/revoke DDLs.

Which has the added benefits to enforce naming conventions for roles,
to enforce grants are only between our "per-DB" roles,
and made it easy to generate an audit-log for all those DDLs.

So the v16 ROLE changes created a BIG MESS for us,
slowing us down quite a bit, but we ended up with a much
better "v2" architecture, so it was not all a loss... YMMV.

So +1 to Pavel. --DD

view thread (4+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: Q: GRANT ... WITH ADMIN on PG 17
  In-Reply-To: <CAFCRh--J96OtjyH8ow5bosKy9J7jqQw-gupYhHhP9QTLK-XwaQ@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox