MIME-Version: 1.0
References: <aKc855Ez-iHiJ6ww@hermes.hilbert.loc> <03be331512b0a52423b86e70018b39b5d2966f52.camel@cybertec.at>
 <b4b4c4ea-b9b0-4435-a84c-d172e01db8cb@postgrespro.ru>
In-Reply-To: <b4b4c4ea-b9b0-4435-a84c-d172e01db8cb@postgrespro.ru>
From: Dominique Devienne <ddevienne@gmail.com>
Date: Mon, 25 Aug 2025 14:38:02 +0200
Message-ID: <CAFCRh--J96OtjyH8ow5bosKy9J7jqQw-gupYhHhP9QTLK-XwaQ@mail.gmail.com>
Subject: Re: Q: GRANT ... WITH ADMIN on PG 17
To: Pavel Luzanov <p.luzanov@postgrespro.ru>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>, Karsten Hilbert <Karsten.Hilbert@gmx.net>, 
	pgsql-general@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAFCRh--J96OtjyH8ow5bosKy9J7jqQw-gupYhHhP9QTLK-XwaQ%40mail.gmail.com>
Precedence: bulk

On Mon, Aug 25, 2025 at 2:22=E2=80=AFPM Pavel Luzanov <p.luzanov@postgrespr=
o.ru> wrote:
>> On 22.08.2025 11:40, Laurenz Albe wrote:
>> Yes, that should work as follows: [...]

> [...] A safer option is to use security definer function to grant members=
hip

FWIW, it's basically what I did.

My primary "admin" application role lost CREATEROLE,
and instead gained EXECUTE on security-definer procs
from a new lower-level role (with CREATEROLE),
in a new separate schema, which does all create/drop
roles or grant/revoke DDLs.

Which has the added benefits to enforce naming conventions for roles,
to enforce grants are only between our "per-DB" roles,
and made it easy to generate an audit-log for all those DDLs.

So the v16 ROLE changes created a BIG MESS for us,
slowing us down quite a bit, but we ended up with a much
better "v2" architecture, so it was not all a loss... YMMV.

So +1 to Pavel. --DD