| From: | Andrew Dunstan <andrew(at)dunslane(dot)net> |
|---|---|
| To: | Robert Haas <robertmhaas(at)gmail(dot)com>, Andres Freund <andres(at)anarazel(dot)de> |
| Cc: | Tomas Vondra <tomas(at)vondra(dot)me>, Ashutosh Sharma <ashu(dot)coek88(at)gmail(dot)com>, pgsql-hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Orphaned users in PG16 and above can only be managed by Superusers |
| Date: | 2025-01-24 14:53:09 |
| Message-ID: | e4ff7917-d65b-43db-b0c0-b07f48ae522f@dunslane.net |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On 2025-01-23 Th 4:06 PM, Robert Haas wrote:
> On Thu, Jan 23, 2025 at 3:51 PM Andres Freund <andres(at)anarazel(dot)de> wrote:
>> I wonder if it's a mistake that a role membership that has WITH ADMIN on
>> another role is silently removed if the member role is removed. We e.g. do
>> *not* do that for pg_auth_members.grantor:
>>
>> ERROR: 2BP01: role "r1" cannot be dropped because some objects depend on it
>> DETAIL: privileges for membership of role r2 in role r3
> Yeah, I'm not sure about this either, but this is the kind of thing I
> was thinking about when I replied before, saying that maybe dropping
> role B shouldn't just succeed. Maybe dropping a role that doesn't have
> privileges to administer any other role should be different than
> dropping one that does.
>
That seems reasonable and consistent with what we do elsewhere, as
Andres noted.
cheers
andrew
--
Andrew Dunstan
EDB: https://www.enterprisedb.com
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Maxim Orlov | 2025-01-24 15:09:14 | Re: postgres_fdw could deparse ArrayCoerceExpr |
| Previous Message | Frédéric Yhuel | 2025-01-24 14:41:46 | Re: doc: explain pgstatindex fragmentation |