REVOKE FROM warning on grantor

From: Étienne BERSAC <etienne(dot)bersac(at)dalibo(dot)com>
To: "pgsql-hackers(at)lists(dot)postgresql(dot)org" <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: REVOKE FROM warning on grantor
Date: 2024-03-14 12:09:37
Message-ID: 9c45a5a19718388678d11e0b48b400ad7e3e3d21.camel@dalibo.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

Since ldap2pg 6, I'm working on running by default as non-super role
with CREATEDB. Robert Haas made this a viable solution as of Postgres
16.

I got a case where ldap2pg tries to remove a role from a group. But
ldap2pg user is not the grantor of this membership. This triggers a
warning:

$ REVOKE owners FROM alice;
WARNING: role "alice" has not been granted membership in role "owners"
by role "ldap2pg"

I'll add a condition on grantor when listing manageable membership to
simply avoid this.

However, I'd prefer if Postgres fails properly. Because the GRANT is
actually not revoked. This prevent ldap2pg to report an issue in
handling privileges on such roles.

What do you think of make this warning an error ?

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Robert Haas 2024-03-14 12:12:36 Re: Flushing large data immediately in pqcomm
Previous Message Masahiko Sawada 2024-03-14 12:03:27 Re: [PoC] Improve dead tuple storage for lazy vacuum