Feedback-ID: i76984098:Fastmail
Message-ID: <cebb02fa-5487-4c06-8527-9c8ba29c13a9@aklaver.com>
Date: Sat, 5 Oct 2024 08:27:21 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: grant connect to all databases
To: Matt Zagrabelny <mzagrabe@d.umn.edu>,
 "David G. Johnston" <david.g.johnston@gmail.com>
Cc: "pgsql-generallists.postgresql.org" <pgsql-general@lists.postgresql.org>
References: <CAOLfK3Vj-PFBJi28y1170ZP3dGeW2qpG_8_9CbaJWvEgXQ8-jQ@mail.gmail.com>
 <CAKFQuwYG8uQhN50MgcF1seg8+dwvgTMFez=wA3Rg2rosob78cg@mail.gmail.com>
 <CAOLfK3XOHnyWsLv_CdFAegWg1FgM3AK3WsO_r+rXSNjp8TQXcg@mail.gmail.com>
Content-Language: en-US
From: Adrian Klaver <adrian.klaver@aklaver.com>
In-Reply-To: <CAOLfK3XOHnyWsLv_CdFAegWg1FgM3AK3WsO_r+rXSNjp8TQXcg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/cebb02fa-5487-4c06-8527-9c8ba29c13a9%40aklaver.com>
Precedence: bulk

On 10/5/24 07:13, Matt Zagrabelny wrote:
> Hi David (and others),
> 
> Thanks for the info about Public.
> 
> I should expound on my original email.
> 
> In our dev and test environments our admins (alice, bob, eve) are 
> superusers. In production environments we'd like the admins to be read-only.

What are the REVOKE and GRANT commands you use to achieve that?

> 
> Is the Public role something I can leverage to achieve this desire?

You should read:

https://www.postgresql.org/docs/current/ddl-priv.html


 From your original post:

"but I cannot connect to my database"

Was that due to a GRANT issue or a pg_hba.conf issue?

What was the actual complete error?

> 
> Thanks for the help!
> 
> -m
> 
> 
> 
> On Sat, Oct 5, 2024 at 9:02 AM David G. Johnston 
> <david.g.johnston@gmail.com <mailto:david.g.johnston@gmail.com>> wrote:
> 
>     On Saturday, October 5, 2024, Matt Zagrabelny <mzagrabe@d.umn.edu
>     <mailto:mzagrabe@d.umn.edu>> wrote:
> 
>         Hello,
> 
>         I'd like to have a read-only user for all databases.
> 
>         I found the pg_read_all_data role predefined role, which I
>         granted to my RO user:
> 
>         GRANT pg_read_all_data TO ro_user;
> 
>         ...but I cannot connect to my database(s).
> 
>         I'd like to not have to iterate over all the databases and
>         "GRANT CONNECT...".
> 
>         Is there a way to do this with just one GRANT or equivalent command?
> 
> 
> 
>     The pseudo-role Public exists for just this kind of thing.  In fact,
>     in a default installation it already is given connect privileges on
>     all databases created by the bootstrap superuser.
> 
>     David J.
> 

-- 
Adrian Klaver
adrian.klaver@aklaver.com