Re: Orphaned users in PG16 and above can only be managed by Superusers

On Wed, Jan 22, 2025 at 6:08 AM Ashutosh Sharma <ashu(dot)coek88(at)gmail(dot)com> wrote:
> Thanks for sharing your thoughts and inputs. I'm also not quite clear
> about the fix. Some of the solutions/changes you've mentioned above
> seem quite complex and may not be reasonable, as you pointed out. How
> about introducing a new predefined role, perhaps something like
> pg_admin_all, which, when granted to an admin user in the system,
> would allow them to manage all non-superusers on the server?

IMHO, this is a hack. Let's suppose the superuser creates roles A and
X with CREATEROLE. A creates B, who creates C. X creates Y, who
creates Z. Now A drops B. We want A to retain the ability to
administer C, but we do not want X to suddenly acquire the ability to
administer C. If A and C both had pg_admin_all, that's what would
happen.

--
Robert Haas
EDB: http://www.enterprisedb.com