From: Michael Glaesemann <grzm@seespotcode.net>
To: Joshua_Kramer <josh@globalherald.net>
Cc: pgsql-sql@postgresql.org
Subject: Re: SUPERUSER vs CREATEUSER causes foul 'code smell'
Date: Thu, 16 Aug 2007 10:35:13 -0500
Message-ID: <E03ABEED-9E95-4741-99BF-6433513F6040@seespotcode.net> (raw)
In-Reply-To: <Pine.LNX.4.64.0708161134270.16729@home-av-server.home-av>
References: <Pine.LNX.4.64.0708161134270.16729@home-av-server.home-av>
On Aug 16, 2007, at 10:36 , Joshua_Kramer wrote:
> In the pg_users view - is there a way to differentiate between a
> role with SUPERUSER priveleges, and a user who merely has the
> CREATEUSER flag?
>
> If I want to create a role who can create other roles, but not have
> other SUPERUSER priveleges - how can I do that?
I think you may be confusing CREATEROLE and CREATEUSER. AIUI,
CREATEUSER is a holdover from the pre-role PostgreSQL days, when
CREATEUSER implied SUPERUSER. (I may very well be wrong with the
explanation, but the effects look the same.) CREATEROLE privilege
does not imply SUPERUSER however.
test=# create role user_creator with createuser;
CREATE ROLE
test=# create role role_creator with createrole;
CREATE ROLE
test=# select rolname, rolsuper, rolcreaterole from pg_roles;
rolname | rolsuper | rolcreaterole
-----------------------------+----------+---------------
postgres | t | t
...
user_creator | t | f
role_creator | f | t
(By the way, I don't see a pg_users view in v8.2.4. There's a pg_user
view and a pg_roles view however. What version are you using?)
Michael Glaesemann
grzm seespotcode net
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: grzm@seespotcode.net, josh@globalherald.net
Subject: Re: SUPERUSER vs CREATEUSER causes foul 'code smell'
In-Reply-To: <E03ABEED-9E95-4741-99BF-6433513F6040@seespotcode.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox