MIME-Version: 1.0
References: <CAFCRh-8+PGGTuqg=rSKA533D0dqYAgq69UzSqMm67VEW02nZyQ@mail.gmail.com>
 <076fe1a7-b72c-4ba1-8589-cd7ece3fd982@aklaver.com>
In-Reply-To: <076fe1a7-b72c-4ba1-8589-cd7ece3fd982@aklaver.com>
From: Dominique Devienne <ddevienne@gmail.com>
Date: Wed, 11 Sep 2024 17:28:04 +0200
Message-ID: <CAFCRh-_-fuE8vSvP1vyqKXFGihfj9RmUB9z1wmEFtbkYTXNHTQ@mail.gmail.com>
Subject: Re: Backward compat issue with v16 around ROLEs
To: Adrian Klaver <adrian.klaver@aklaver.com>
Cc: pgsql-general@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAFCRh-_-fuE8vSvP1vyqKXFGihfj9RmUB9z1wmEFtbkYTXNHTQ%40mail.gmail.com>
Precedence: bulk

On Wed, Sep 11, 2024 at 5:09=E2=80=AFPM Adrian Klaver <adrian.klaver@aklave=
r.com> wrote:
> What user did you do the above as?

My own user, which lacks SUPERUSER (I have CREATEROLE and CREATEDB
only, and LOGIN of course).

> On my Postgres 16.4 instance logged in as postgres:

> test=3D# create role dd_owner createrole;
> CREATE ROLE
> test=3D# create role dd_admin noinherit;
> CREATE ROLE
> test=3D# grant dd_owner to dd_admin;
> GRANT ROLE
> test=3D# set role dd_owner;
> SET

This failed for me, but works for you, probably because you are SUPERUSER.

> test=3D> grant dd_owner to current_user;
> ERROR:  permission denied to grant role "dd_owner"
> DETAIL:  Only roles with the ADMIN option on role "dd_owner" may grant
> this role.

A role can't grant itself to someone? Hmmm...

> test=3D> create role dd_user;
> CREATE ROLE
> test=3D> grant dd_admin to dd_user;
> ERROR:  permission denied to grant role "dd_admin"
> DETAIL:  Only roles with the ADMIN option on role "dd_admin" may grant
> this role.

This is the error I'm trying to fix on v16, and was OK on v14.
So your v16.4 behaves the same as my v16.1 it seems. --DD