From: | "David G(dot) Johnston" <david(dot)g(dot)johnston(at)gmail(dot)com> |
---|---|
To: | Robert Haas <robertmhaas(at)gmail(dot)com> |
Cc: | Peter Eisentraut <peter(dot)eisentraut(at)enterprisedb(dot)com>, Joe Conway <mail(at)joeconway(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, "Bossart, Nathan" <bossartn(at)amazon(dot)com>, Stephen Frost <sfrost(at)snowman(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: replacing role-level NOINHERIT with a grant-level option |
Date: | 2022-06-13 18:42:28 |
Message-ID: | CAKFQuwa5YxEHqv-xu4__A5fv=+aL59vZquYjFiahudwT6pfsuw@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Mon, Jun 13, 2022 at 11:01 AM Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> Some
>
syntax would be a bit different on the new releases and that would
> unlock some new options we don't currently have, but there's no
> behavior that you can get today which you wouldn't be able to get any
> more under this proposal.
>
Agreed. Moving the inherit flag to the many-to-many join relation provides
flexibility, while representing the present behavior is trivial - every row
for a given member role has the same value for said flag.
One seemingly missing feature is to specify for a role that its privileges
cannot be inherited. In this case associations where it is the group role
mustn't be flagged inherit. Symmetrically, "inherit only" seems like a
plausible option for pre-defined group roles.
I agree that granting membership makes the pg_auth_members record appear
and revoking membership makes it disappear.
I dislike having GRANT do stuff when membership is already established.
ALTER MEMBER role IN group ALTER [SET | ASSUME] [TO | =] [TRUE | FALSE]
David J.
From | Date | Subject | |
---|---|---|---|
Next Message | Robert Haas | 2022-06-13 19:34:31 | Re: replacing role-level NOINHERIT with a grant-level option |
Previous Message | Robert Haas | 2022-06-13 18:20:18 | Re: better page-level checksums |