Re: v16 roles, SET FALSE, INHERIT FALSE, ADMIN FALSE

On 09.07.2024 00:16, Tom Lane wrote:
> Pavel Luzanov<p(dot)luzanov(at)postgrespro(dot)ru> writes:
>> On 08.07.2024 22:22, Christophe Pettus wrote:
>>> This is more curiosity than anything else. In the v16 role system, is there actually any reason to grant membership in a role to a different role, but with SET FALSE, INHERIT FALSE, and ADMIN FALSE? Does the role granted membership gain any ability it didn't have before in that case?
>> Looks like there is one ability.
>> Authentication in pg_hba.conf "USER" field via +role syntax.
> Hmm, if that check doesn't require INHERIT TRUE I'd say it's
> a bug.
>
> regards, tom lane

My test scenario:

postgres(at)demo(16.3)=# select * from pg_hba_file_rules ;
rule_number | file_name | line_number | type | database | user_name | address | netmask | auth_method | options | error
-------------+-------------------------------------+-------------+-------+----------+------------+---------+---------+-------------+---------+-------
1 | /etc/postgresql/16/main/pg_hba.conf | 118 | local | {all} | {postgres} | | | trust | |
2 | /etc/postgresql/16/main/pg_hba.conf | 121 | local | {all} | {+bob} | | | trust | |
3 | /etc/postgresql/16/main/pg_hba.conf | 122 | local | {all} | {alice} | | | reject | |
(3 rows)

postgres(at)demo(16.3)=# \drg
List of role grants
Role name | Member of | Options | Grantor
-----------+-----------+---------+----------
alice | bob | | postgres
(1 row)

postgres(at)demo(16.3)=# \c - alice
You are now connected to database "demo" as user "alice".
alice(at)demo(16.3)=>

--
Pavel Luzanov
Postgres Professional:https://postgrespro.com