how to find out the users added to a role in postgresql ? - postgresql

I am working on postgresql ver 9.4.5. I am adding users to super user role(master) as below:
grant testuser1 to master;
grant testuser2 to master;
Now how to find out the list of users added to this role "master".Is there any specific system tables/views to query this ? I need to pass the role name 'maser' in the where clause.
Many Thanks

I have tried this and belwo query shows result correctly. Could someone confirm whether this query is correct ?
testdb= #grant testuser1 to master;
GRANT ROLE
testdb= #grant testuser2 to master;
GRANT ROLE
testdb= #grant testuser3 to master;
GRANT ROLE
SELECT rolname FROM pg_roles WHERE
pg_has_role( 'master', oid, 'member')
and rolname not in ( 'master')
rolname
----------------
testuser1
testuser2
testuser3
(3 rows)
Many Thanks,

Related

Unable to get pg_settings from non-postgres user

I have the following query to get the settings for max_running_jobs.
select *
from pg_settings
where name = 'cron.max_running_jobs';
I'm able to get the records from postgres user but not with the non-postgres user.
Any grant/permission I got missed?
by this REF: https://pgpedia.info/p/pg_settings.html
the permission should be:
GRANT SELECT, UPDATE ON pg_settings TO PUBLIC;
you can confirm it running:
SELECT grantee, string_agg(privilege_type, ', ') AS privileges
FROM information_schema.role_table_grants
WHERE table_name='pg_settings'
GROUP BY grantee;

Granting user membership to another role does not give it the same permissions to objects the other role owns

FYI I'm using google cloud sql postgres (postgres 13), but I don't think it is modifying default behavior.
My understanding was if I assign a user membership to a role that owns an object the user inherits the same permissions, but I am not seeing this.
-- login an user1, create a new table and confirm I can query it
CREATE TABLE test01 (did integer);
SELECT * FROM test01;
-- assign user2 member to the user1 role
GRANT "user2" TO "user1";
-- login as user2 and try to query
SELECT * FROM test01;
-- get a permissions error
ERROR: permission denied for table test01
Is this expected behavior? Shouldn't user1 get all the permissions user2 has on the objects it owns?
You may want to opt to use ALTER ROLE to specify group membership (or include IN ROLE or IN GROUP when doing CREATE ROLE -- note that in Postgres, roles/groups are interchangeable).
Here's an example:
-- Create user1
postgres=# create role user1 LOGIN;
CREATE ROLE
-- Use user1 to create table
postgres=# \c postgres user1;
You are now connected to database "postgres" as user "user1".
postgres=> CREATE TABLE test01 (did integer);
CREATE TABLE
postgres=> SELECT * FROM test01;
did
-----
(0 rows)
-- Create user2, belonging to the group/role user1
postgres=> \c postgres postgres
You are now connected to database "postgres" as user "postgres".
postgres=# create role user2 IN GROUP user1 LOGIN;
CREATE ROLE
-- Use user2 to select from the table
postgres=# \c postgres user2;
You are now connected to database "postgres" as user "user2".
postgres=> SELECT * FROM test01;
did
-----
(0 rows)
This is very dumb, perhaps I should delete this post, but someone already attempted to answer it and perhaps this is helpful to another user.
I had the grant statement backwards.
GRANT "user1" TO "user2";
NOT
GRANT "user2" TO "user1";
I guess the language got me. I was thinking of it in terms of giving role X permission to role Y but your giving role Y membership to role X

Postgres - grant permission to an existing user in a role group

I am trying to grant permissions to a user within a role group, where are the steps that I did:
create the user: myuser
create the role group: read_only
grant read_only to myuser
grant select on all tables in schema public to read_only
alter default priviliges in schema public grant select on tables to read_only
after all the steps above, when I use myuser to query the tables, I got 'permission denied'. Anything I missed here?
Altering default privileges only affects new tables. You will want to grant the privileges on all existing tables by issuing the below in order for you to have permissions.
GRANT SELECT ON ALL TABLES IN SCHEMA public TO read_only;

Why can't I see user privileges in postgresql?

I am using PostgreSQL 11.8 in AWS RDS and I created a user as below:
CREATE USER test WITH LOGIN;
GRANT rds_iam TO test;
the code runs success but I can't find the user test from:
SELECT * FROM information_schema.table_privileges where grantee='test';
it returns an empty result to me.
I am able to see that user by running
SELECT *FROM pg_catalog.pg_user where usename='test';.
Why can't I grant access to the user?
Your GRANT statement didn't grant a privilege on a table, it added the user to the role (“group”) rds_iam.
User test itself doesn't have any privileges on tables, it only inherits them.
information_schema.table_privileges will only show the privileges that were granted to a user, not the privileges inherited via role membership.
Your SQL command is correct. The problem is on the given role_name. You can get all users by executing the below command
SELECT *FROM pg_catalog.pg_user
Make sure the given role_name is in the listed role name in the PostgreSQL server. Below the command, you can get users with role
SELECT usename AS role_name,
CASE
WHEN usesuper AND usecreatedb THEN
CAST('superuser, create database' AS pg_catalog.text)
WHEN usesuper THEN
CAST('superuser' AS pg_catalog.text)
WHEN usecreatedb THEN
CAST('create database' AS pg_catalog.text)
ELSE
CAST('' AS pg_catalog.text)
END role_attributes
FROM pg_catalog.pg_user
ORDER BY role_name desc;
In PostgreSQL RDS I seen this behavior, where "information_schema.table_privileges" is not getting updated with privileges which granted to any user or role If the table owner is not "dbuser".
So I changed the table owner to "dbuser" immediately it's started showing all the grants which I granted to different users and roles. Not sure how the "Table owner" impacting "table_privileges" view.

ERROR: permission denied for relation tablename on Postgres while trying a SELECT as a readonly user

GRANT SELECT ON ALL TABLES IN SCHEMA public TO readonly;
The readonly user can connect, see the tables but when it tries to do a simple select it gets:
ERROR: permission denied for relation mytable
SQL state: 42501
This is happening on PostgreSQL 9.1
What I did wrong?
Here is the complete solution for PostgreSQL 9+, updated recently.
CREATE USER readonly WITH ENCRYPTED PASSWORD 'readonly';
GRANT USAGE ON SCHEMA public to readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO readonly;
-- repeat code below for each database:
GRANT CONNECT ON DATABASE foo to readonly;
\c foo
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO readonly; --- this grants privileges on new tables generated in new database "foo"
GRANT USAGE ON SCHEMA public to readonly;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO readonly;
Thanks to https://jamie.curle.io/creating-a-read-only-user-in-postgres/ for several important aspects
If anyone find shorter code, and preferably one that is able to perform this for all existing databases, extra kudos.
Try to add
GRANT USAGE ON SCHEMA public to readonly;
You probably were not aware that one needs to have the requisite permissions to a schema, in order to use objects in the schema.
This worked for me:
Check the current role you are logged into by using:
SELECT CURRENT_USER, SESSION_USER;
Note: It must match with Owner of the schema.
Schema | Name | Type | Owner
--------+--------+-------+----------
If the owner is different, then give all the grants to the current user role from the admin role by :
GRANT 'ROLE_OWNER' to 'CURRENT ROLENAME';
Then try to execute the query, it will give the output as it has access to all the relations now.
make sure your user has attributes on its role. for example:
postgres=# \du
List of roles
Role name | Attributes | Member of
-----------+------------------------------------------------+-----------
flux | | {}
postgres | Superuser, Create role, Create DB, Replication | {}
after performing the following command:
postgres=# ALTER ROLE flux WITH Superuser;
ALTER ROLE
postgres=# \du
List of roles
Role name | Attributes | Member of
-----------+------------------------------------------------+-----------
flux | Superuser | {}
postgres | Superuser, Create role, Create DB, Replication | {}
it fixed the problem.
see tutorial for roles and stuff here: https://www.digitalocean.com/community/tutorials/how-to-use-roles-and-manage-grant-permissions-in-postgresql-on-a-vps--2
You should execute the next query:
GRANT ALL ON TABLE mytable TO myuser;
Or if your error is in a view then maybe the table does not have permission, so you should execute the next query:
GRANT ALL ON TABLE tbm_grupo TO myuser;