Thread: Backing out of privilege grants rabbit hole
https://www.postgresql.org/docs/12/sql-drop-owned.html
On Apr 2, 2020, at 20:34 , AC Gomez <antklc@gmail.com> wrote:Do I understand correctly that if a role was assigned countless object privileges and you want to delete that role you have to sift through a myriad of privilege grants in what amounts to a time consuming trial and error exercise until you've got them all?Or is there a single command that with just delete the role and do a blanket grant removal at the same time?ul[class*='mb-extra__public-links'], ul[class*='mb-note__public-links'], ul[class*='mb-task__public-links'] { display: none !important; }
More fully:
REASSIGN OWNED BY doomed_role TO successor_role; DROP OWNED BY doomed_role; -- repeat the above commands in each database of the cluster DROP ROLE doomed_role;
On Apr 2, 2020, at 20:37 , Guyren Howe <guyren@gmail.com> wrote:https://www.postgresql.org/docs/12/sql-drop-owned.htmlOn Apr 2, 2020, at 20:34 , AC Gomez <antklc@gmail.com> wrote:Do I understand correctly that if a role was assigned countless object privileges and you want to delete that role you have to sift through a myriad of privilege grants in what amounts to a time consuming trial and error exercise until you've got them all?Or is there a single command that with just delete the role and do a blanket grant removal at the same time?ul[class*='mb-extra__public-links'], ul[class*='mb-note__public-links'], ul[class*='mb-task__public-links'] { display: none !important; }
Thanks for the quick response. The problem is, in most cases the owner is not the grantee. So if a role, let's say a temp employee, gets grants, then leaves, I can't do a drop owned because that temp never owned those objects, he just was granted access. Is there a "drop granted" kind of thing?
On Thu, Apr 2, 2020, 11:37 PM Guyren Howe <guyren@gmail.com> wrote:
https://www.postgresql.org/docs/12/sql-drop-owned.htmlOn Apr 2, 2020, at 20:34 , AC Gomez <antklc@gmail.com> wrote:Do I understand correctly that if a role was assigned countless object privileges and you want to delete that role you have to sift through a myriad of privilege grants in what amounts to a time consuming trial and error exercise until you've got them all?Or is there a single command that with just delete the role and do a blanket grant removal at the same time?