public inbox for [email protected]
help / color / mirror / Atom feedFrom: Joe Conway <[email protected]>
To: Nathan Bossart <[email protected]>
To: Robert Haas <[email protected]>
Cc: Tom Lane <[email protected]>
Cc: Bossart, Nathan <[email protected]>
Cc: Stephen Frost <[email protected]>
Cc: PostgreSQL-development <[email protected]>
Subject: Re: replacing role-level NOINHERIT with a grant-level option
Date: Fri, 1 Jul 2022 06:17:32 -0400
Message-ID: <[email protected]> (raw)
In-Reply-To: <20220701025830.GA369935@nathanxps13>
References: <[email protected]>
<CA+TgmoYeNB1PxMO-TYv4_Ky7XR3-3Le+fpL87T7QMR=OWc7U1Q@mail.gmail.com>
<[email protected]>
<CA+Tgmoax3J2D1RoqSqBRuLVifMjinZ5SPvR+rBqBT89u57zOJQ@mail.gmail.com>
<[email protected]>
<CA+TgmoYmJtLA1aFF2dpGLuqWMuWwrf2SEoT-Ueqd4XCzLL61sA@mail.gmail.com>
<20220629231939.GA362451@nathanxps13>
<CA+Tgmobuqgr3XKujMwgsEZUxBHJA8jZSH2tVp7PC1cifePANtw@mail.gmail.com>
<20220630232931.GA367181@nathanxps13>
<CA+TgmoZWWqB66t4K6Mqv6TDttO1YJRJhOJO77B5H9Z8f28yc8Q@mail.gmail.com>
<20220701025830.GA369935@nathanxps13>
On 6/30/22 22:58, Nathan Bossart wrote:
> On Thu, Jun 30, 2022 at 10:21:53PM -0400, Robert Haas wrote:
>> On Thu, Jun 30, 2022 at 7:29 PM Nathan Bossart <[email protected]> wrote:
>>> IIUC you are suggesting that we'd leave rolinherit in pg_authid alone, but
>>> we'd add the ability to specify a grant-level option that would always take
>>> precedence. The default (WITH INHERIT DEFAULT) would cause things to work
>>> exactly as they do today (i.e., use rolinherit). Does this sound right?
>>
>> Yeah, that could be an alternative to the patch I proposed previously.
>> What do you (and others) think of that idea?
>
> I like it. If rolinherit is left in place, existing pg_dumpall scripts
> will continue to work, and folks can continue to use the role-level option
> exactly as they do today. However, we'd be adding the ability to use a
> grant-level option if desired, and it would be relatively easy to reason
> about (i.e., the grant-level option always takes precedence over the
> role-level option). Also, AFAICT this strategy still provides the full set
> of behavior that would be possible if only the grant-level option existed.
Would this allow for an explicit REVOKE to override a default INHERIT
along a specific path?
--
Joe Conway
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com
view thread (74+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Subject: Re: replacing role-level NOINHERIT with a grant-level option
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox