Follow

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use
Contact

GRANT USER to another user does not grant permissions

I have user ‘administrator’ with CREATEROLE privileges. I create new user like this:

CREATE USER test_user;

And then i grant privileges to the new user:

GRANT administrator TO test_user;

When i’m logged in as ‘administrator’, i can create users without a problem, since ‘administrator’ has the privilege to do it. But for some reason ‘test_user’ can’t create users. When i’m trying it, i get this output:

MEDevel.com: Open-source for Healthcare and Education

Collecting and validating open-source software for healthcare, education, enterprise, development, medical imaging, medical records, and digital pathology.

Visit Medevel

ERROR:  permission denied to create role

Output of \du:

List of roles
   Role name   |                         Attributes                         |    Member of    
---------------+------------------------------------------------------------+-----------------
 administrator | Create role                                                | {}
 analyst       |                                                            | {}
 manager       |                                                            | {}
 postgres      | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
 test_user     |                                                            | {administrator}

>Solution :

I think you misunderstood how role memberships work:

The members of a group role can use the privileges of the role in two ways. First, member roles that have been granted membership with the SET option can do SET ROLE to temporarily “become” the group role. In this state, the database session has access to the privileges of the group role rather than the original login role, and any database objects created are considered owned by the group role not the login role. Second, member roles that have been granted membership with the INHERIT option automatically have use of the privileges of those roles, including any privileges inherited by those roles.

So you need to

GRANT administrator TO test_user WITH INHERIT TRUE;

To just use administrator privileges as test_user without switching between them.

Add a comment

Leave a Reply

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use

Discover more from Dev solutions

Subscribe now to keep reading and get access to the full archive.

Continue reading