| From: | Robert Haas <robertmhaas(at)gmail(dot)com> |
|---|---|
| To: | Andres Freund <andres(at)anarazel(dot)de> |
| Cc: | Tomas Vondra <tomas(at)vondra(dot)me>, Ashutosh Sharma <ashu(dot)coek88(at)gmail(dot)com>, pgsql-hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Orphaned users in PG16 and above can only be managed by Superusers |
| Date: | 2025-01-23 21:06:15 |
| Message-ID: | CA+TgmoamUHwazAL-qYOVSZX9BSXEa_OMHP2+fVsaPdE9j4RH0g@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Thu, Jan 23, 2025 at 3:51 PM Andres Freund <andres(at)anarazel(dot)de> wrote:
> I wonder if it's a mistake that a role membership that has WITH ADMIN on
> another role is silently removed if the member role is removed. We e.g. do
> *not* do that for pg_auth_members.grantor:
>
> ERROR: 2BP01: role "r1" cannot be dropped because some objects depend on it
> DETAIL: privileges for membership of role r2 in role r3
Yeah, I'm not sure about this either, but this is the kind of thing I
was thinking about when I replied before, saying that maybe dropping
role B shouldn't just succeed. Maybe dropping a role that doesn't have
privileges to administer any other role should be different than
dropping one that does.
--
Robert Haas
EDB: http://www.enterprisedb.com
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Jeff Davis | 2025-01-23 21:29:14 | Re: Inconsistent string comparison using modified ICU collations |
| Previous Message | Robert Haas | 2025-01-23 21:03:15 | Re: Orphaned users in PG16 and above can only be managed by Superusers |