From ce4605354f1360662ffed6f0e239b2e06d107a85 Mon Sep 17 00:00:00 2001 From: "David G. Johnston" Date: Wed, 17 Jan 2024 14:19:54 -0700 Subject: [PATCH] v2 --- doc/src/sgml/ref/create_role.sgml | 81 +++++++++++++++++-------------- 1 file changed, 45 insertions(+), 36 deletions(-) diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgml index 5c2b71bf69..f134feea27 100644 --- a/doc/src/sgml/ref/create_role.sgml +++ b/doc/src/sgml/ref/create_role.sgml @@ -133,29 +133,29 @@ in sync when changing the above synopsis! NOINHERIT - This controls the membership inheritance status when a new role - is added as a member using the IN ROLE clause, - when this role is later added as a member of a new role with the - ROLE clause, and the default inheritance when - adding this role as a member using the GRANT - statement. In such GRANT statements, the - role's inheritance status will be used unless overridden by the - GRANT WITH INHERIT clause. + This controls whether a newly established membership of this role in + another has the INHERIT option. + Specifically, when this role is created with an IN ROLE + clause, is specified in the ROLE clause + of a future CREATE ROLE command, or when this + role is the "TO" role in a GRANT command + that does not specify INHERIT in the + WITH clause. - Role membership with the inherit attribute can automatically - use whatever database privileges have been granted to all - roles it is directly or indirectly a member of, though the - chain stops at memberships without the inherit attribute. - Without role inheritance, the only other value of membership - is via SET ROLE, assuming the membership has - the SET attribute. + See "GRANT on Roles" on the GRANT reference page + for more information on what the INHERIT option + on a membership grant does. + + + + If not specified, INHERIT is the default. In PostgreSQL versions before 16, - the GRANT statement did not support + the GRANT command did not support WITH INHERIT. Therefore, changing this role-level property would also change the behavior of already-existing grants. This is no longer the case. @@ -293,9 +293,12 @@ in sync when changing the above synopsis! The IN ROLE clause causes the new role to be automatically added as a member of the specified existing - roles. (Note that there is no option to add the new role as an - administrator or to disallow SET ROLE; use a - separate GRANT command to do that.) + roles. The new role will have the SET option + on the named role(s), and the INHERIT option + unless the NOINHERIT attribute has been specified for this role. + The new role will not have the ADMIN option. + See the GRANT command for modifying these options + after the new role is created. @@ -305,8 +308,11 @@ in sync when changing the above synopsis! The ROLE clause causes one or more specified - existing roles to be automatically added as members of the new - role. This in effect makes the new role a group. + existing roles to be automatically added as members, with the + SET option, of the new role. Any named roles with + the INHERIT attribute will also have the INHERIT + option in the membership grant. + This in effect makes the new role a group. @@ -315,10 +321,9 @@ in sync when changing the above synopsis! ADMIN role_name - The ADMIN clause is like ROLE, - but the named roles are added to the new role WITH ADMIN - OPTION, giving them the right to grant membership in this role - to others. + The ADMIN clause behaves identical to the ROLE clause, + but the named roles are also added to the new role(s) with the ADMIN option, + giving them the right to grant membership in this role to others. @@ -361,15 +366,19 @@ in sync when changing the above synopsis! - The INHERIT attribute governs inheritance of grantable - privileges (that is, access privileges for database objects and role - memberships). It does not apply to the special role attributes set by - CREATE ROLE and ALTER ROLE. For example, being - a member of a role with CREATEDB privilege does not immediately - grant the ability to create databases, even if INHERIT is set; - it would be necessary to become that role via - SET ROLE before - creating a database. + The role attributes defined here are non-inheritable, i.e., being a + member of a role with, e.g., CREATEDB will not + allow the member to create new databases even if the membership grant + has the INHERIT option. Of course, if the membership + grant has the SET option the member role would be able to + SET ROLE to the + createdb role and then create a new database. + + + + The membership grants created by the + IN ROLE, ROLE, and ADMIN + clauses have the role executing this command as the grantee. @@ -469,8 +478,8 @@ CREATE ROLE name [ WITH ADMIN The behavior specified by the SQL standard is most closely approximated by giving LOGIN roles - the NOINHERIT attribute, while - NOLOGINroles are given the INHERIT + the NOINHERIT attribute, while giving + NOLOGIN roles the INHERIT attribute. -- 2.34.1