MIME-Version: 1.0
In-Reply-To: <aKdCfim8i_TNw16S@hermes.hilbert.loc>
References: <aKc855Ez-iHiJ6ww@hermes.hilbert.loc> <3662a9b9-3e58-4977-8bd1-e1ed0e25b2a8@aklaver.com>
 <aKdCfim8i_TNw16S@hermes.hilbert.loc>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Thu, 21 Aug 2025 09:11:57 -0700
Message-ID: <CAKFQuwbYv_dcJQ8AWmQWka1MhDvQLCxjcoquf4XjEBuZ9zEm5w@mail.gmail.com>
Subject: Re: Q: GRANT ... WITH ADMIN on PG 17
To: Karsten Hilbert <Karsten.Hilbert@gmx.net>
Cc: Adrian Klaver <adrian.klaver@aklaver.com>, 
	"pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000004a9e20063ce259c6"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwbYv_dcJQ8AWmQWka1MhDvQLCxjcoquf4XjEBuZ9zEm5w%40mail.gmail.com>
Precedence: bulk

--0000000000004a9e20063ce259c6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, August 21, 2025, Karsten Hilbert <Karsten.Hilbert@gmx.net>
wrote:

> Am Thu, Aug 21, 2025 at 08:46:00AM -0700 schrieb Adrian Klaver:
>
> > >PG 17 documentation says that using "WITH ADMIN" allows the
> > >role being added to another group role to grant/revoke
> > >membership in said group to other roles.
> >
> > I would start by reading this:
> >
> > https://rhaas.blogspot.com/2023/01/surviving-without-
> superuser-coming-to.html
>
> Thanks, I did, but did not find the answer to: Is there a
> way for a role that can manage membership in a group role to
> not itself be a member of that group role ?
>

A superuser can do this.  Otherwise, no.  In order to be made admin of a
role on must be a member of said role - i.e., =E2=80=9Cwith admin=E2=80=9D =
is only part of
the =E2=80=9Cgrant=E2=80=9D command.  You won=E2=80=99t find docs talking a=
bout alternatives
because they don=E2=80=99t exist.

David J.

--0000000000004a9e20063ce259c6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, August 21, 2025, Karsten Hilbert &lt;<a href=3D"mailto:Karsten=
.Hilbert@gmx.net">Karsten.Hilbert@gmx.net</a>&gt; wrote:<br><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa=
dding-left:1ex">Am Thu, Aug 21, 2025 at 08:46:00AM -0700 schrieb Adrian Kla=
ver:<br>
<br>
&gt; &gt;PG 17 documentation says that using &quot;WITH ADMIN&quot; allows =
the<br>
&gt; &gt;role being added to another group role to grant/revoke<br>
&gt; &gt;membership in said group to other roles.<br>
&gt; <br>
&gt; I would start by reading this:<br>
&gt; <br>
&gt; <a href=3D"https://rhaas.blogspot.com/2023/01/surviving-without-superu=
ser-coming-to.html" target=3D"_blank">https://rhaas.blogspot.com/<wbr>2023/=
01/surviving-without-<wbr>superuser-coming-to.html</a><br>
<br>
Thanks, I did, but did not find the answer to: Is there a<br>
way for a role that can manage membership in a group role to<br>
not itself be a member of that group role ?<br>
</blockquote><div><br></div><div>A superuser can do this.=C2=A0 Otherwise, =
no.=C2=A0 In order to be made admin of a role on must be a member of said r=
ole - i.e., =E2=80=9Cwith admin=E2=80=9D is only part of the =E2=80=9Cgrant=
=E2=80=9D command.=C2=A0 You won=E2=80=99t find docs talking about alternat=
ives because they don=E2=80=99t exist.</div><div><br></div><div>David J.</d=
iv><div><br></div>

--0000000000004a9e20063ce259c6--