PostgreSQL Createrole Permission for User – How to Grant

postgresqlroleusers

I created a role with createrole flag, but users in this role trying to create users fail with permissions denied. Do I need to assign the createrole to each user instead of just the role (group)?

my steps were as follow:

create role group1 with nologin createrole;
create user user1 PASSWORD 'password' in role group1;

then login as user1 and trying to create user newuser fails with the error permission denied to create role

Best Answer

According to the docs, you have to use SET ROLE before actually using the createrole privilege.

Connect as user1 and issue

SET ROLE group1;
CREATE ROLE newuser;

Also, beware - CREATEROLE is in fact equivalent of superuser. This is also said in the docs.

Related Solutions

Postgresql – Problem with permissions for user

GRANTing ALL permissions for public to the database is mostly redundant (as public has connect, temporary by default, so you'd only be adding CREATE which you probably don't want to do). You probably expected a GRANT ALL on the database to result in a recursive GRANT ALL to contained schemas and tables. GRANT is not recursive, so this doesn't happen; a GRANT ALL on a database just grants CONNECT and TEMPORARY rights to the database, with no effect on contained schemas and tables.

The default GRANTs are, from the docs on GRANT:

PostgreSQL grants default privileges on some types of objects to PUBLIC. No privileges are granted to PUBLIC by default on tables, columns, schemas or tablespaces. For other types, the default privileges granted to PUBLIC are as follows: CONNECT and CREATE TEMP TABLE for databases; EXECUTE privilege for functions; and USAGE privilege for languages. The object owner can, of course, REVOKE both default and expressly granted privileges. (For maximum security, issue the REVOKE in the same transaction that creates the object; then there is no window in which another user can use the object.) Also, these initial default privilege settings can be changed using the ALTER DEFAULT PRIVILEGES command.

So you can see you don't need to GRANT anything on the database unless you want the user to be able to create schemas, etc. You need to:

GRANT USAGE ON SCHEMA myschema TO theuser; for any schema other than public. CREATE can be granted if you want the user to be able to make tables, views, etc.
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE sometable TO theuser; for tables. I've omitted the TRUNATE, REFERENCES and TRIGGER rights as you probably don't want to grant them.
GRANT USAGE ON SEQUENCE sometable_somecolumn_seq TO theuser; for any sequences that are used in table defaults, either explicitly or via a SERIAL or BIGSERIAL column.

... etc. See the manual for GRANT linked above for full definitions of what the privileges do, which are available on which objects, etc. Take note of the wildcard ALL TABLES and ALL SEQUENCES options.

If this seems like too much hassle to do for each table, view, schema, sequence, etc, you can in Pg 9.1 and above use ALTER DEFAULT PRIVILEGES to change the default GRANTs on new objects.

The manual for GRANT
The manual for ALTER DEFAULT PRIVILEGES

Sql-server – Add user to sql server with the required permission

Use a database role. Database roles are database specific (obviously) so you can't create a role that grant's permissions to multiple databases at once. However within the database you create a role either through the GUI or using the command CREATE ROLE <rolename>. Once it is created you can then grant the role permissions just like you would a user. Then you add users to the role. Again you can either use the GUI or the command EXEC sp_addrolemember '<rolename>','<username>'. And last but not least there are some pre-defined roles at both the server and database level. (You can't create server roles in SQL 2008.) You can not make changes to the pre-defined roles but among others there is db_datareader which grants SELECT permission to every table in the database. Oh, and you can add your user defined role to the pre-defined role. So you could create a role MyReadOnlyRole and add it to db_datareader and then grant it EXECUTE permissions to various stored procedures, functions etc. Or EXECUTE permission to the database itself for that matter. (That gives permission to execute any SP, function etc in the database.)

Best Answer

Related Solutions

Postgresql – Problem with permissions for user

Sql-server – Add user to sql server with the required permission

Related Question