agora inbox for pgsql-sql@postgresql.org
help / color / mirror / Atom feedFrom: Tom Lane <tgl@sss.pgh.pa.us>
To: ROS Didier <didier.ros@edf.fr>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: pgsql-sql@postgresql.org <pgsql-sql@postgresql.org>
Subject: Re: problem with read-only user
Date: Fri, 20 Dec 2019 09:04:57 -0500
Message-ID: <2743.1576850697@sss.pgh.pa.us> (raw)
In-Reply-To: <0d4a7143cb7b4a749ca7e4603e6a795e@PCYINTPEXMU001.NEOPROD.EDF.FR>
References: <0d4a7143cb7b4a749ca7e4603e6a795e@PCYINTPEXMU001.NEOPROD.EDF.FR>
ROS Didier <didier.ros@edf.fr> writes:
> I created a read-only role as follows:
> psql -p 5434 kidsdpn03
> CREATE ROLE kidsdpn03_ro PASSWORD 'xxx';
> ALTER ROLE kidsdpn03_ro WITH LOGIN;
> GRANT CONNECT ON DATABASE kidsdpn03 TO kidsdpn03_ro;
> GRANT USAGE ON SCHEMA kidsdpn03 TO kidsdpn03_ro;
> GRANT SELECT ON ALL TABLES IN SCHEMA kidsdpn03 TO kidsdpn03_ro;
> GRANT SELECT ON ALL SEQUENCES IN SCHEMA kidsdpn03 TO kidsdpn03_ro;
> ALTER DEFAULT PRIVILEGES IN SCHEMA kidsdpn03 GRANT SELECT ON TABLES TO kidsdpn03_ro;
> ALTER ROLE kidsdpn03_ro SET search_path TO kidsdpn03;
> but when i create new tables, i don't have read access to those new tables.
You only showed us part of what you did ... but IIRC,
ALTER DEFAULT PRIVILEGES only affects privileges for objects
subsequently made by the same user that issued the command.
(Otherwise it'd be a security issue.) So maybe you didn't
make the tables as the same user?
regards, tom lane
view thread (3+ messages) latest in thread
Message-ID: <2743.1576850697@sss.pgh.pa.us>
Permalink: ../2743.1576850697@sss.pgh.pa.us/
Also on: postgresql.org/message-id/2743.1576850697@sss.pgh.pa.us
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, didier.ros@edf.fr, pgsql-hackers@postgresql.org
Subject: Re: problem with read-only user
In-Reply-To: <2743.1576850697@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox