Re: privilege inheritance to a login role through a group role

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: privilege inheritance to a login role through a group role
Дата
Msg-id 20824.1238542758@sss.pgh.pa.us
обсуждение исходный текст
Ответ на privilege inheritance to a login role through a group role  (Kasia Tuszynska <ktuszynska@esri.com>)
Ответы Re: privilege inheritance to a login role through a group role  (Alvaro Herrera <alvherre@commandprompt.com>)
Список pgsql-admin
Kasia Tuszynska <ktuszynska@esri.com> writes:
> I am having issues with privilege inheritance to a login role through a group role.

> These are the steps I am performing:

>  1.  data: stcities belongs to user gdb, it resides in the gdb schema
>  2.  map user is a login role:
> CREATE ROLE map LOGIN
>   ENCRYPTED PASSWORD 'md59ec9dda576db2a36c42c1c3af155d07c'
>   NOSUPERUSER NOINHERIT CREATEDB NOCREATEROLE;

>  1.  editor role is created, and privileges to the data are granted to it:
> CREATE ROLE editor NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE;
> GRANT select on gdb.stcities TO editor;

>  1.  user map is made a member of the editor role:
> GRANT editor TO map;

> Now, theoretically, I am expecting the map role to be able to inherit the select privileges via the editor group role
tothe gdb.stcities data. 

You've got the INHERIT bit backwards: you'd have to apply INHERIT to
map, not editor, to have editor's privileges automatically work for map.

If there's some identifiable bit of the documentation that confused you
about this, please point it out so we can improve it.

            regards, tom lane

В списке pgsql-admin по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: Re: backup question
Следующее
От: Carol Walter
Дата:
Сообщение: psql & pg_dump