MIME-Version: 1.0
In-Reply-To: <CAFCRh-8+PGGTuqg=rSKA533D0dqYAgq69UzSqMm67VEW02nZyQ@mail.gmail.com>
References: <CAFCRh-8+PGGTuqg=rSKA533D0dqYAgq69UzSqMm67VEW02nZyQ@mail.gmail.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Wed, 11 Sep 2024 08:06:34 -0700
Message-ID: <CAKFQuwYK2Vdnbdaxh9QF_0PYpztg51nc-iqYeiKDfpzek7hTdQ@mail.gmail.com>
Subject: Re: Backward compat issue with v16 around ROLEs
To: Dominique Devienne <ddevienne@gmail.com>
Cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000096fcd0621d956de"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwYK2Vdnbdaxh9QF_0PYpztg51nc-iqYeiKDfpzek7hTdQ%40mail.gmail.com>
Precedence: bulk

--000000000000096fcd0621d956de
Content-Type: text/plain; charset="UTF-8"

On Wednesday, September 11, 2024, Dominique Devienne <ddevienne@gmail.com>
wrote:

>
> on v16:
>
> D:\pdgm\trunk\psc2>psql service=pau16
> psql (17beta3, server 16.1)
> Type "help" for help.
>
> ddevienne=> create role dd_owner createrole;
> CREATE ROLE
> ddevienne=> create role dd_admin noinherit;
> CREATE ROLE
> ddevienne=> grant dd_owner to dd_admin;


As the error indicates, this grant needs to be done with admin option.

Since the with admin option exists in versions prior to v16 this change
should work in all of your deployments.


> GRANT ROLE
> ddevienne=> set role dd_owner;
> ERROR:  permission denied to set role "dd_owner"
> ddevienne=> grant dd_owner to current_user;
> GRANT ROLE
> ddevienne=> set role dd_owner;
> SET
> ddevienne=> create role dd_user;
> CREATE ROLE
> ddevienne=> grant dd_admin to dd_user;
> ERROR:  permission denied to grant role "dd_admin"
> DETAIL:  Only roles with the ADMIN option on role "dd_admin" may grant


See comment above.


> this role.
> ddevienne=>
>
>
David J.

--000000000000096fcd0621d956de
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wednesday, September 11, 2024, Dominique Devienne &lt;<a href=3D"mailto:=
ddevienne@gmail.com">ddevienne@gmail.com</a>&gt; wrote:<br><blockquote clas=
s=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pad=
ding-left:1ex"><br>
on v16:<br>
<br>
D:\pdgm\trunk\psc2&gt;psql service=3Dpau16<br>
psql (17beta3, server 16.1)<br>
Type &quot;help&quot; for help.<br>
<br>
ddevienne=3D&gt; create role dd_owner createrole;<br>
CREATE ROLE<br>
ddevienne=3D&gt; create role dd_admin noinherit;<br>
CREATE ROLE<br>
ddevienne=3D&gt; grant dd_owner to dd_admin;</blockquote><div><br></div><di=
v>As the error indicates, this grant needs to be done with admin option.</d=
iv><div><br></div><div>Since the with admin option exists in versions prior=
 to v16 this change should work in all of your deployments.</div><div>=C2=
=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex">
GRANT ROLE<br>
ddevienne=3D&gt; set role dd_owner;<br>
ERROR:=C2=A0 permission denied to set role &quot;dd_owner&quot;<br>
ddevienne=3D&gt; grant dd_owner to current_user;<br>
GRANT ROLE<br>
ddevienne=3D&gt; set role dd_owner;<br>
SET<br>
ddevienne=3D&gt; create role dd_user;<br>
CREATE ROLE<br>
ddevienne=3D&gt; grant dd_admin to dd_user;<br>
ERROR:=C2=A0 permission denied to grant role &quot;dd_admin&quot;<br>
DETAIL:=C2=A0 Only roles with the ADMIN option on role &quot;dd_admin&quot;=
 may grant</blockquote><div><br></div><div>See comment above.</div><div>=C2=
=A0<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;b=
order-left:1px #ccc solid;padding-left:1ex">
this role.<br>
ddevienne=3D&gt;<br><br>
</blockquote><div><br></div><div>David J.</div><div>=C2=A0</div>

--000000000000096fcd0621d956de--