If you use Hibernate to create tables, those tables are inaccessible to other users (they are owned by cloudsqladmin). All attempts to GRANT permission to other users have failed, so when I'm accessing it via shell or GUI using the only credentials I have (the non-cloudsqladmin users), they have no access to these tables other than to list the columns in the table.
Through IAM I have granted the service account access to all permissions.
eg. logged in as the postgres user:
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO postgres;
ERROR: permission denied for relation mytable
GRANT SELECT ON post to postgres;
ERROR: permission denied for relation mytable
ALTER TABLE public.mytable OWNER to postgres;
ERROR: must be owner of relation mytable
I would like to note that the postgres user is able to fully manipulate tables that were not created with hibernate, and hibernate is able to fully manipulate the data, just not the other users I created.
So the final solution was painfully simple. Simply:
GRANT user_you_authed_in_java TO user_you_want_to_use;
Related
I am running this command
gcloud sql import sql db1 gs://mybucket/sqldumpfile.gz --database=mydb1
to import a database snapshot into a new database. Before running it, I recreated the same users I had in the source database, using Cloud Console. However, I keep on getting this error:
ERROR: must be member of role "postgres"
STATEMENT: ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT SELECT ON TABLES TO user1;
I am not sure what to do and which user must be "member of role postgres".
Any advice is appreciated
To grant default privileges for user2, use the FOR ROLE clause:
ALTER DEFAULT PRIVILEGES FOR USER <user-1> IN SCHEMA <user-1> GRANT INSERT, UPDATE, DELETE ON TABLES TO <user-2>;
ALTER DEFAULT PRIVILEGES FOR USER <user-1> IN SCHEMA <user-1> GRANT SELECT ON TABLES TO <user-2>;
You need to grant the rights from the user-1 which is creating the table, So whenever the user-1 creates a table, it will grant the SELECT rights for the user-2.
For more information refer to this document.
I have a problem with a select in postgres. Create a db with a new user but in pg admin when applying a query within the program it returns me
ERROR: permission denied for table users
Apply a query to give privileges with:
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO someuser;
as well as a query to give privileges to the table but nothing: /
I've successfully setup pgHero using the permissions guide here.
Everything is working, including historical query stats, except for the ability run analyze on queries that it shows are slow.
I get PG::InsufficientPrivilege: ERROR: permission denied for table <tableName>
How can I grant permission to analyze to the pghero user?
Turns out this is as simple as granting SELECT (and whatever other) privileges to the pghero user like so:
# Grant select access for all current tables
GRANT SELECT ON ALL TABLES IN SCHEMA public TO pghero;
# For all future tables
ALTER DEFAULT PRIVILEGES FOR ROLE <main-user> IN SCHEMA public GRANT SELECT ON TABLES TO pghero;
How does privileges for new relations in PostgreSQL work?
Steps:
Create DB (from user postgres) and connect to it
CREATE DATABASE test;
\c test
Create user site with some privileges
CREATE USER site NOCREATEDB NOINHERIT;
GRANT SELECT, UPDATE, INSERT, DELETE, TRUNCATE, REFERENCES ON ALL TABLES IN SCHEMA public TO site;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO site;
Change default privileges for user site
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, UPDATE, INSERT, DELETE, TRUNCATE, REFERENCES ON TABLES TO site;
Create user migration with all privileges
CREATE USER migration NOCREATEDB NOINHERIT;
GRANT ALL PRIVILEGES ON DATABASE test TO migration;
Connect to DB from user migration and create table
CREATE TABLE test (id serial);
Connect to DB from user site and select data from created table
SELECT * FROM test;
ERROR: permission denied for relation test
But if I create table from user postgres, all work fine!
Why default privileges didn't work in this case? How can I grant permissions for new tables for user site?
ALTER DEFAULT PRIVILEGES only affects objects created by the user specified in the FOR ROLE clause. If you omit this clause, it only applies to the user running the command (in your case, postgres).
You want ALTER DEFAULT PRIVILEGES FOR USER migration ... instead.
I need to restrict a user, access only on a particualr schema tables only.So I tried following query and login as user1_gmail_com. But I got following error when I try to browse any schema table.
My Query:
SELECT clone_schema('my_application_template_schema','user1_gmail_com');
CREATE USER user1_gmail_com WITH PASSWORD 'myloginpassword';
REVOKE ALL ON ALL TABLES IN SCHEMA user1_gmail_com FROM PUBLIC;
GRANT SELECT ON ALL TABLES IN SCHEMA user1_gmail_com TO user1_gmail_com;
SQL error:
ERROR: permission denied for schema user1_gmail_com at character 46
In statement:
SELECT COUNT(*) AS total FROM (SELECT * FROM "user1_gmail_com"."organisations_table") AS sub
Updated Working Query:
SELECT clone_schema('my_application_template_schema','user1_gmail_com');
CREATE USER user1_gmail_com WITH PASSWORD 'myloginpassword';
REVOKE ALL ON ALL TABLES IN SCHEMA user1_gmail_com FROM PUBLIC;
GRANT USAGE ON SCHEMA user1_gmail_com TO user1_gmail_com;
GRANT SELECT ON ALL TABLES IN SCHEMA user1_gmail_com TO user1_gmail_com;
You need to grant access not only to the tables in the schema, but also to the schema itself.
From the manual:
By default, users cannot access any objects in schemas they do not own. To allow that, the owner of the schema must grant the USAGE privilege on the schema.
So either make your created user the owner of the schema, or grant USAGE on the schema to this user.
This confused me. Still not sure I'm handling it correctly. Run \h grant for the syntax within psql. Here is how I managed to get my other users and groups to work as I needed:
GRANT ALL PRIVILEGES ON SCHEMA foo TO GROUP bar;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA foo TO GROUP bar;
I kept getting this error when using flyway to deploy database changes. I do some manual setup first, such as creating the database, so flyway wouldn't need those super-admin permissions.
My Fix
I had to ensure that the database user that flyway job used had ownership rights to the public schema, so that the flyway user could then assign the right to use the schema to other roles.
Additional setup Details
I am using AWS RDS (both regular and Aurora), and they don't allow super users in the databases. RDS reserves super users for use by AWS, only, so that consumers are unable to break the replication stuff that is built in. However, there's a catch-22 that you must be an owner in postgres to be able to modify it.
My solution was to create a role that acts as the owner ('owner role'), and then assign both my admin user and the flyway user to the owner role, and use ALTER scripts for each object to assign the object's owner to the owner role.
I missed the public schema, since that was auto-created when I created the database script manually. The public schema defaulted to my admin role rather than the shared owner role. So when the flyway user tried to assign public schema permissions to other roles, it didn't have the authority to do that. An error was not thrown during flyway execution, however.