PostgreSQL數據庫超級用戶

Question

我試圖如下，以確保多個模式的由一個數據庫： -

-public 
-foo 
-bar 
-foobar 

我想創建誰可以訪問任何架構讀取用戶，可以創建在酒吧桌和可惰性/更新/刪除foo，bar和foobar

我寧願創建用戶作爲數據庫超級用戶，然後根據需要刪除權限。

心想： -

CREATE USER test_superuser; 
GRANT ALL on DATABASE test to test_superuser; 

會做到這一點，但這些命令後test_superuser無法訪問模式。

如何創建具有postgres超級用戶權限但僅限於指定數據庫的用戶？

Answer 1

原來這需要大量修補才能實現： -

 CREATE ROLE test_database_superuser 
    NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL '2020-03-06 00:00:00'; 


    CREATE ROLE test_user LOGIN 
     ENCRYPTED PASSWORD 'md52b250919b406b707999fffb2b9f673fb' 
     NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL '2020-03-06 00:00:00'; 

    GRANT test_database_superuser TO test_user; 

    --DATABASE LEVEL PRIVELEGES 
    GRANT ALL PRIVILEGES ON DATABASE test to test_database_superuser; 

    --SCHEMA LEVEL 
    GRANT ALL ON SCHEMA bar TO GROUP test_database_superuser; 
    GRANT USAGE ON SCHEMA foo TO GROUP test_database_superuser; 
    GRANT USAGE ON SCHEMA foobar TO GROUP test_database_superuser; 

    GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA foo TO GROUP test_database_superuser; 
    GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA foo TO GROUP test_database_superuser; 

    GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA bar TO GROUP test_database_superuser; 
    GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA bar TO GROUP test_database_superuser; 

    GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA foobar TO GROUP test_database_superuser; 
    GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA foobar TO GROUP test_database_superuser; 


    --PUBLIC 
    GRANT USAGE ON SCHEMA public TO GROUP test_database_superuser; 

Answer 2

允許usage of the schema

GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } 
    ON SCHEMA schema_name [, ...] 
    TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ] 

喜歡的東西：

GRANT USAGE ON SCHEMA your_schame TO test_superuser; 

順便說一句，這不是一個 「超級用戶」，只是有很多權限的用戶...

Answer 3

下面是一個例子：

$ sudo su - postgres 
postgres@derrick:~$ createuser -P 
Enter name of role to add: web_app 
Enter password for new role: 
Enter it again: 
Shall the new role be a superuser? (y/n) n 
Shall the new role be allowed to create databases? (y/n) n 
Shall the new role be allowed to create more new roles? (y/n) n 
postgres@derrick:~$ 

postgres@derrick:~$ createdb --owner web_app dbTest 
postgres@derrick:~$ logout