MIME-Version: 1.0
References: <69A2A7BD-F8CA-4067-B229-B5F9FC6A884F@thebuild.com>
In-Reply-To: <69A2A7BD-F8CA-4067-B229-B5F9FC6A884F@thebuild.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Mon, 8 Jul 2024 12:58:06 -0700
Message-ID: <CAKFQuwaSk4Ftn52X3aup9upDkurAunTHLB1XtZb0Pkzs7TTYUA@mail.gmail.com>
Subject: Re: v16 roles, SET FALSE, INHERIT FALSE, ADMIN FALSE
To: Christophe Pettus <xof@thebuild.com>
Cc: pgsql-general <pgsql-general@postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000001d1662061cc1d77f"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwaSk4Ftn52X3aup9upDkurAunTHLB1XtZb0Pkzs7TTYUA%40mail.gmail.com>
Precedence: bulk

--0000000000001d1662061cc1d77f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Jul 8, 2024 at 12:23=E2=80=AFPM Christophe Pettus <xof@thebuild.com=
> wrote:

>
> This is more curiosity than anything else.  In the v16 role system, is
> there actually any reason to grant membership in a role to a different
> role, but with SET FALSE, INHERIT FALSE, and ADMIN FALSE?  Does the role
> granted membership gain any ability it didn't have before in that case?
>
>
That scenario is allowed but provides no useful in-server behavior.  I
suppose the membership presence/absence could be given external meaning by
a DBA.  Personally, I'd just add a metric on the server counting these and
alert if it is ever non-zero.

David J.

--0000000000001d1662061cc1d77f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"fon=
t-family:arial,helvetica,sans-serif"><span style=3D"font-family:Arial,Helve=
tica,sans-serif">On Mon, Jul 8, 2024 at 12:23=E2=80=AFPM Christophe Pettus =
&lt;<a href=3D"mailto:xof@thebuild.com" target=3D"_blank">xof@thebuild.com<=
/a>&gt; wrote:</span><br></div></div><div class=3D"gmail_quote"><blockquote=
 class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px so=
lid rgb(204,204,204);padding-left:1ex"><br>
This is more curiosity than anything else.=C2=A0 In the v16 role system, is=
 there actually any reason to grant membership in a role to a different rol=
e, but with SET FALSE, INHERIT FALSE, and ADMIN FALSE?=C2=A0 Does the role =
granted membership gain any ability it didn&#39;t have before in that case?=
<br>
<br></blockquote><div><br></div><div class=3D"gmail_default" style=3D"font-=
family:arial,helvetica,sans-serif">That scenario is allowed but provides no=
 useful in-server behavior.=C2=A0 I suppose the membership presence/absence=
 could be given external meaning by a DBA.=C2=A0 Personally, I&#39;d just a=
dd a metric on the server counting these and alert if it is ever non-zero.<=
/div><div class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans=
-serif"><br></div><div class=3D"gmail_default" style=3D"font-family:arial,h=
elvetica,sans-serif">David J.</div><div class=3D"gmail_default" style=3D"fo=
nt-family:arial,helvetica,sans-serif"><br></div></div></div>

--0000000000001d1662061cc1d77f--