I've successfully setup pgHero using the permissions guide here.
Everything is working, including historical query stats, except for the ability run analyze on queries that it shows are slow.
I get PG::InsufficientPrivilege: ERROR: permission denied for table <tableName>
How can I grant permission to analyze to the pghero user?
Turns out this is as simple as granting SELECT (and whatever other) privileges to the pghero user like so:
# Grant select access for all current tables
GRANT SELECT ON ALL TABLES IN SCHEMA public TO pghero;
# For all future tables
ALTER DEFAULT PRIVILEGES FOR ROLE <main-user> IN SCHEMA public GRANT SELECT ON TABLES TO pghero;
Related
I am running this command
gcloud sql import sql db1 gs://mybucket/sqldumpfile.gz --database=mydb1
to import a database snapshot into a new database. Before running it, I recreated the same users I had in the source database, using Cloud Console. However, I keep on getting this error:
ERROR: must be member of role "postgres"
STATEMENT: ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT SELECT ON TABLES TO user1;
I am not sure what to do and which user must be "member of role postgres".
Any advice is appreciated
To grant default privileges for user2, use the FOR ROLE clause:
ALTER DEFAULT PRIVILEGES FOR USER <user-1> IN SCHEMA <user-1> GRANT INSERT, UPDATE, DELETE ON TABLES TO <user-2>;
ALTER DEFAULT PRIVILEGES FOR USER <user-1> IN SCHEMA <user-1> GRANT SELECT ON TABLES TO <user-2>;
You need to grant the rights from the user-1 which is creating the table, So whenever the user-1 creates a table, it will grant the SELECT rights for the user-2.
For more information refer to this document.
I'm trying to achieve the following:
I have user1 which is created.
This user1 has databases user1_db1, user1_db2 , user1_db3
When I grant the owner of user1 to all the databases, I am able to do everything with them,except if I create user1_user1 , grant All access ( without the owner ) to user1_db. Then user1_user1 will throw errors like :
user1_user1=> ALTER DATABASE "user1_dbl" SET bytea_output = 'escape';
ERROR: must be owner of database user1_db1
What I need is a special user ( in this case user1_user1 ) to be able to do everything with the database that all access have been granted and is still visible in phppgadmin ( when $conf['owned_only'] = true; is set ) when logged with user1 , or if needed I can create a special user for PHPpgAdmin but must view the databases that are with prefix user1 only.
Maybe my approach is not proper so please let me know how can I achieve this.
The goal is to have 1 user , able to access/modify all those databases and in the same scenario , user1_user1 is able to do the same but not accessing phppgadmin. The limitation that I am seeing is the ownership only and I am not able to bypass it...
Thank you for your advices!
You can use the same user for all of the databases, but you will need to give that user access to each database. You can do that by running the following SQL:
GRANT ALL PRIVILEGES ON DATABASE user1_db1 TO user1_user1; GRANT ALL PRIVILEGES ON DATABASE user1_db2 TO user1_user1; GRANT ALL PRIVILEGES ON DATABASE user1_db3 TO user1_user1;
You can also give the user access to all databases by running the following SQL:
GRANT ALL PRIVILEGES ON ALL DATABASES TO user1_user1;
You can also give the user access to all tables in a database by running the following SQL:
GRANT ALL PRIVILEGES ON user1_db1.* TO user1_user1;
You can also give the user access to all tables in all databases by running the following SQL:
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO user1_user1;
You can also give the user access to all sequences in a database by running the following SQL:
GRANT ALL PRIVILEGES ON user1_db1 TO user1_user1;
You can also give the user access to all sequences in all databases by running the following SQL:
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO user1_user1;
You can also give the user access to all functions in a database by running the following SQL:
GRANT ALL PRIVILEGES ON user1_db1 TO user1_user1;
You can also give the user access to all functions in all databases by running the following SQL:
GRANT ALL PRIVILEGES ON ALL FUNCTIONS IN SCHEMA public TO user1_user1;
You can also give the user access to all types in a database by running the following SQL:
GRANT ALL PRIVILEGES ON user1_db1 TO user1_user1;
You can also give the user access to all types in all databases by running the following SQL:
GRANT ALL PRIVILEGES ON ALL TYPES IN SCHEMA public TO user1_user1;
You can also give the user access to all operators in a database by running the following SQL:
GROMySQL: How to grant all privileges on all databases and tables to a user?
The best way to do this is to use the GRANT ALL PRIVILEGES ON . TO 'user'#'localhost' syntax.
GRANT ALL PRIVILEGES ON *.* TO 'user'#'localhost' IDENTIFIED BY 'password';
This will give the user all privileges on all databases and tables.
I finally made it work with the memberships :
postgres=# \du
List of roles
Role name | Attributes | Member of
-------------------+------------------------------------------------------------+---------------------
user1 | | {user1_pgsqluser}
user1_pgsqluser | | {}
This can be granted as follow :
psql -U postgres -c 'grant $dbuser to $user;'
I can't grant a new role on all tables. A table denies the query. How can I grant the user to be able run this command?
CREATE ROLE userrole123 WITH LOGIN PASSWORD 'userrole123' VALID UNTIL '2024-01-07 09:37:39.0' INHERIT;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO userrole123;
Output
SQL Error [42501]: ERROR: permission denied for table test
I run this command GRANT USAGE ON SCHEMA public to myusername but it did not solve it.
Thanks
The documentation is pretty outspoken there:
Ordinarily, only the object's owner (or a superuser) can grant or revoke privileges on an object. However, it is possible to grant a privilege “with grant option”, which gives the recipient the right to grant it in turn to others.
So obviously the user who is running the GRANT is neither a superuser, nor does it own test, nor has it been granted the SELECT privilege WITH GRANT OPTION.
I want to create a Postgres user that has just read-only access to the database.
I saw a similar question, but it had no resolution for my error.
I even tried searching for the error but didn't find anything useful.
Syntax:
GRANT CONNECT ON DATABASE YourDatabaseName TO Read_Only_User;
GRANT USAGE ON SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO Read_Only_User;
# You can either grant USAGE to everyone
GRANT USAGE ON SCHEMA public TO public;
# Or grant it just to your read only user
GRANT USAGE ON SCHEMA public TO readonlyuser;
But none worked. I logged in as a root user.
I many times ended with the error
ERROR: permission denied for relation querystoresearchclient
Could anyone help here?
I need to restrict a user, access only on a particualr schema tables only.So I tried following query and login as user1_gmail_com. But I got following error when I try to browse any schema table.
My Query:
SELECT clone_schema('my_application_template_schema','user1_gmail_com');
CREATE USER user1_gmail_com WITH PASSWORD 'myloginpassword';
REVOKE ALL ON ALL TABLES IN SCHEMA user1_gmail_com FROM PUBLIC;
GRANT SELECT ON ALL TABLES IN SCHEMA user1_gmail_com TO user1_gmail_com;
SQL error:
ERROR: permission denied for schema user1_gmail_com at character 46
In statement:
SELECT COUNT(*) AS total FROM (SELECT * FROM "user1_gmail_com"."organisations_table") AS sub
Updated Working Query:
SELECT clone_schema('my_application_template_schema','user1_gmail_com');
CREATE USER user1_gmail_com WITH PASSWORD 'myloginpassword';
REVOKE ALL ON ALL TABLES IN SCHEMA user1_gmail_com FROM PUBLIC;
GRANT USAGE ON SCHEMA user1_gmail_com TO user1_gmail_com;
GRANT SELECT ON ALL TABLES IN SCHEMA user1_gmail_com TO user1_gmail_com;
You need to grant access not only to the tables in the schema, but also to the schema itself.
From the manual:
By default, users cannot access any objects in schemas they do not own. To allow that, the owner of the schema must grant the USAGE privilege on the schema.
So either make your created user the owner of the schema, or grant USAGE on the schema to this user.
This confused me. Still not sure I'm handling it correctly. Run \h grant for the syntax within psql. Here is how I managed to get my other users and groups to work as I needed:
GRANT ALL PRIVILEGES ON SCHEMA foo TO GROUP bar;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA foo TO GROUP bar;
I kept getting this error when using flyway to deploy database changes. I do some manual setup first, such as creating the database, so flyway wouldn't need those super-admin permissions.
My Fix
I had to ensure that the database user that flyway job used had ownership rights to the public schema, so that the flyway user could then assign the right to use the schema to other roles.
Additional setup Details
I am using AWS RDS (both regular and Aurora), and they don't allow super users in the databases. RDS reserves super users for use by AWS, only, so that consumers are unable to break the replication stuff that is built in. However, there's a catch-22 that you must be an owner in postgres to be able to modify it.
My solution was to create a role that acts as the owner ('owner role'), and then assign both my admin user and the flyway user to the owner role, and use ALTER scripts for each object to assign the object's owner to the owner role.
I missed the public schema, since that was auto-created when I created the database script manually. The public schema defaulted to my admin role rather than the shared owner role. So when the flyway user tried to assign public schema permissions to other roles, it didn't have the authority to do that. An error was not thrown during flyway execution, however.