{"id":16513,"date":"2021-07-01T06:37:56","date_gmt":"2021-07-01T04:37:56","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/"},"modified":"2021-07-01T06:37:56","modified_gmt":"2021-07-01T04:37:56","slug":"new-predefined-roles-for-postgresql-14","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/","title":{"rendered":"New predefined roles for PostgreSQL 14"},"content":{"rendered":"

Time is moving fast and PostgreSQL 14 is already in beta 2<\/a>. PostgreSQL 14 will ship with a lot of new features and in this post will look at a smaller one: There are three new predefined roles: pg_read_all_data, pg_write_all_data and pg_database_owner. While it seems to be obvious what the first two roles are about, the third one might sound strange at the beginning. Let’s have a look.<\/p>\n

<\/p>\n

We’ll start with a sample setup, as always:<\/p>\n

\npostgres=# create user u1 with login password 'u1';\nCREATE ROLE\npostgres=# create user u2 with login password 'u2';\nCREATE ROLE\npostgres=# create user u3 with login password 'u3';\nCREATE ROLE\npostgres=# create schema s1;\nCREATE SCHEMA\npostgres=# create schema s2;\nCREATE SCHEMA\npostgres=# alter schema s1 owner to u1;\nALTER SCHEMA\npostgres=# alter schema s2 owner to u2;\nALTER SCHEMA\npostgres=# c postgres u1\nYou are now connected to database \"postgres\" as user \"u1\".\npostgres=> create table s1.t1 ( a int, b text, c date);\nCREATE TABLE\npostgres=> insert into s1.t1 select i,i::text,now() from generate_series(1,1000000) i;\nINSERT 0 1000000\nostgres=> c postgres u2\nYou are now connected to database \"postgres\" as user \"u2\".\npostgres=> create table s2.t1 ( a int, b text, c date);\nCREATE TABLE\npostgres=> insert into s2.t1 select i,i::text,now() from generate_series(1,1000000) i;\nINSERT 0 1000000\npostgres=> c postgres postgres\nYou are now connected to database \"postgres\" as user \"postgres\".\n<\/pre>\n
We’ve created three users (u1,u2,u3) and two schemas (s1,s2). The s1 schema is owned by u1 and the s2 schema is owned by u2. Both users (u1,u2) have a table with some data in their schemas. The u3 user currently does not have anything.<\/p>\n
When we connect as user u3 we of course do not have any permissions on the schemas we created above:<\/p>\n
\npostgres=# c postgres u3\nYou are now connected to database \"postgres\" as user \"u3\".\npostgres=> select count(*) from s1.t1;\nERROR:  permission denied for schema s1\nLINE 1: select count(*) from s1.t1;\n                             ^\npostgres=> select count(*) from s2.t1;\nERROR:  permission denied for schema s2\nLINE 1: select count(*) from s2.t1;\n                             ^\npostgres=> c postgres postgres\nYou are now connected to database \"postgres\" as user \"postgres\".\n<\/pre>\n
Granting pg_read_all_data to u3 gives as read access to all objects:<\/p>\n
\npostgres=# grant pg_read_all_data to u3;\nGRANT ROLE\npostgres=# c postgres u3\nYou are now connected to database \"postgres\" as user \"u3\".\npostgres=> select count(*) from s1.t1;\n  count  \n---------\n 1000000\n(1 row)\n\npostgres=> select count(*) from s2.t1;\n  count  \n---------\n 1000000\n(1 row)\n<\/pre>\n
Writing data or creating object is not yet possible:<\/p>\n
\npostgres=> select current_user;\n current_user \n--------------\n u3\n(1 row)\n\npostgres=> create table s1.t2(a int);\nERROR:  permission denied for schema s1\nLINE 1: create table s1.t2(a int);\n                     ^\npostgres=> create table s2.t2(a int);\nERROR:  permission denied for schema s2\nLINE 1: create table s2.t2(a int);\n\npostgres=> c postgres postgres\nYou are now connected to database \"postgres\" as user \"postgres\".\n<\/pre>\n
This is what pg_write_all_data seems to be about:<\/p>\n
\npostgres=> c postgres postgres\nYou are now connected to database \"postgres\" as user \"postgres\".\npostgres=# grant pg_write_all_data to u3;\nGRANT ROLE\npostgres=# c postgres u3\nYou are now connected to database \"postgres\" as user \"u3\".\npostgres=> create table s1.t2(a int);\nERROR:  permission denied for schema s1\nLINE 1: create table s1.t2(a int);\n                     ^\npostgres=> create table s2.t2(a int);\nERROR:  permission denied for schema s2\nLINE 1: create table s2.t2(a int);\n<\/pre>\n
This role does not grant permissions to create new objects but it grant permission to write data into existing relations:<\/p>\n
\npostgres=> select current_user;\n current_user \n--------------\n u3\n(1 row)\n\npostgres=> insert into s1.t1 values (-1,'xxx',now() );\nINSERT 0 1\npostgres=> insert into s2.t1 values (-1,'xxx',now() );\nINSERT 0 1\n<\/pre>\n
As roles are global objects that works for all databases in a cluster:<\/p>\n
\npostgres=> c postgres postgres\nYou are now connected to database \"postgres\" as user \"postgres\".\npostgres=# create database db1;\nCREATE DATABASE\npostgres=# c db1\nYou are now connected to database \"db1\" as user \"postgres\".\ndb1=# create schema s1;\nCREATE SCHEMA\ndb1=# create table s1.t1(a int);\nCREATE TABLE\ndb1=# insert into s1.t1 values(1);\nINSERT 0 1\ndb1=# c db1 u3\nYou are now connected to database \"db1\" as user \"u3\".\ndb1=> select * from s1.t1;\n a \n---\n 1\n(1 row)\n\ndb1=> insert into s1.t1 values(2);\nINSERT 0 1\n<\/pre>\n
This is really nice if you want to give a specific user or role read and\/or write permissions for all objects in all databases.<\/p>\n
Finally the third predefined role: pg_database_owner. What is this about? Let’s grant that role to the u3 user:<\/p>\n
\ndb1=> c postgres postgres\nYou are now connected to database \"postgres\" as user \"postgres\".\npostgres=# grant pg_database_owner to u3;\nERROR:  role \"pg_database_owner\" cannot have explicit members\n<\/pre>\n
A new predefined role that can not be granted explicitly? Looking at the role definition it can not do much:<\/p>\n
\npostgres=# x\nExpanded display is on.\npostgres=# select * from pg_roles where rolname = 'pg_database_owner';\n-[ RECORD 1 ]--+------------------\nrolname        | pg_database_owner\nrolsuper       | f\nrolinherit     | t\nrolcreaterole  | f\nrolcreatedb    | f\nrolcanlogin    | f\nrolreplication | f\nrolconnlimit   | -1\nrolpassword    | ********\nrolvaliduntil  | \nrolbypassrls   | f\nrolconfig      | \noid            | 6171\n<\/pre>\n
What is it there for then? The answer is here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Time is moving fast and PostgreSQL 14 is already in beta 2. PostgreSQL 14 will ship with a lot of new features and in this post will look at a smaller one: There are three new predefined roles: pg_read_all_data, pg_write_all_data and pg_database_owner. While it seems to be obvious what the first two roles are about, […]<\/p>\n","protected":false},"author":28,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229],"tags":[77],"type_dbi":[],"class_list":["post-16513","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring","tag-postgresql"],"acf":[],"yoast_head":"\nNew predefined roles for PostgreSQL 14 - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New predefined roles for PostgreSQL 14\" \/>\n<meta property=\"og:description\" content=\"Time is moving fast and PostgreSQL 14 is already in beta 2. PostgreSQL 14 will ship with a lot of new features and in this post will look at a smaller one: There are three new predefined roles: pg_read_all_data, pg_write_all_data and pg_database_owner. While it seems to be obvious what the first two roles are about, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-07-01T04:37:56+00:00\" \/>\n<meta name=\"author\" content=\"Open source Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Open source Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/\"},\"author\":{\"name\":\"Open source Team\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"headline\":\"New predefined roles for PostgreSQL 14\",\"datePublished\":\"2021-07-01T04:37:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/\"},\"wordCount\":300,\"commentCount\":0,\"keywords\":[\"PostgreSQL\"],\"articleSection\":[\"Database Administration & Monitoring\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/\",\"name\":\"New predefined roles for PostgreSQL 14 - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"datePublished\":\"2021-07-01T04:37:56+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/new-predefined-roles-for-postgresql-14\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New predefined roles for PostgreSQL 14\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/4bae5e5dd8c7d48edbd948772b49b202\",\"name\":\"Open source Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g\",\"caption\":\"Open source Team\"},\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/open-source-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"New predefined roles for PostgreSQL 14 - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/","og_locale":"en_US","og_type":"article","og_title":"New predefined roles for PostgreSQL 14","og_description":"Time is moving fast and PostgreSQL 14 is already in beta 2. PostgreSQL 14 will ship with a lot of new features and in this post will look at a smaller one: There are three new predefined roles: pg_read_all_data, pg_write_all_data and pg_database_owner. While it seems to be obvious what the first two roles are about, […]","og_url":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/","og_site_name":"dbi Blog","article_published_time":"2021-07-01T04:37:56+00:00","author":"Open source Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Open source Team","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/"},"author":{"name":"Open source Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"headline":"New predefined roles for PostgreSQL 14","datePublished":"2021-07-01T04:37:56+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/"},"wordCount":300,"commentCount":0,"keywords":["PostgreSQL"],"articleSection":["Database Administration & Monitoring"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/","url":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/","name":"New predefined roles for PostgreSQL 14 - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2021-07-01T04:37:56+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/new-predefined-roles-for-postgresql-14\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"New predefined roles for PostgreSQL 14"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/4bae5e5dd8c7d48edbd948772b49b202","name":"Open source Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eb4fb12e386e8c41fdef0733e8114594cf2653e4f55e9fa2161442b8eaf3f657?s=96&d=mm&r=g","caption":"Open source Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/open-source-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/16513","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=16513"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/16513\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=16513"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=16513"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=16513"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=16513"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}