MIME-Version: 1.0
References: <CAFCRh-9byA_kmskbL5duYsjqZG3N78KuvY6TkiT3KuRo27=4QQ@mail.gmail.com>
 <3070156.1730828552@sss.pgh.pa.us>
In-Reply-To: <3070156.1730828552@sss.pgh.pa.us>
From: Dominique Devienne <ddevienne@gmail.com>
Date: Tue, 5 Nov 2024 19:21:35 +0100
Message-ID: <CAFCRh-9TeQ=tWiMDKmSZBW3JxY60Nn6Mf4AnWohixKQFOk7+TA@mail.gmail.com>
Subject: Re: Switching to NOINHERIT user triggers #XX000 error
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-general@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAFCRh-9TeQ%3DtWiMDKmSZBW3JxY60Nn6Mf4AnWohixKQFOk7%2BTA%40mail.gmail.com>
Precedence: bulk

On Tue, Nov 5, 2024 at 6:42=E2=80=AFPM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Dominique Devienne <ddevienne@gmail.com> writes:
> > On v16 and v17 though, it works with INHERIT, but with NOINHERIT, I get=
:
> > GRANT "...:USER" TO "ddevienne" #XX000: ERROR:  no possible grantors
> > Any clue to what this means, so I can start looking in the right place?
>
> \errverbose in psql would help you locate what part of the code
> is throwing that.  (Or if triggering it from psql is not convenient,
> set log_error_verbosity =3D verbose and find the info in the postmaster
> log.)
>
> This is probably a bug, at least to the extent that we don't like
> XX000 errors to be easily reachable, so please let us know what
> you find out.

Hi Tom.

Finding where the error is thrown is easy, it's when I'm doing that grant.
But the code creates two larguish schemas before that and several ROLEs,
so it's not easy to share.

I trapped the error in the code, and here's the details

ERROR:  XX000: no possible grantors
LOCATION:  check_role_grantor, user.c:2229

I used PQresultVerboseErrorMessage().
Tell me if you need some other error field
This is against a 17.0 server, for the line number above.

If I shared (privately) a libpq client-side trace with you Tom, would
that help you?

This particular test, I could redesign to work-around this issue probably.
But this is not the only tests that fails with a NOINHERIT user on v16+,
and I haven't tracked down all the reasons yet...

PS: I can't easily get server-side logs