8

There are plenty of similar questions, but I'm still unable to understand something simple about postgres ALTER, DROP, roles and permissions.

I want to have a DB with multiple users belonging to the same group. When one of the users creates a table, others should be able to use it as if they created it themselves. I can make it work to some extent, but the ALTER and DROP remain a mystery.

For example, starting from scratch I create a database with two users:

CREATE DATABASE test_db;
\c test_db 

CREATE ROLE alice LOGIN INHERIT;
CREATE ROLE bjork LOGIN INHERIT;

Then I create a group and assign users to the group:

CREATE ROLE scientists;
GRANT scientists TO alice;
GRANT scientists TO bjork;
ALTER DEFAULT PRIVILEGES FOR ROLE alice GRANT ALL ON TABLES to scientists;
ALTER DEFAULT PRIVILEGES FOR ROLE bjork GRANT ALL ON TABLES to scientists;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES to scientists;

alice creates a table:

\c - alice
CREATE TABLE test_table (column_a TEXT);

bjork can read, write, but can't neither ALTER, nor DROP:

\c - bjork 
ALTER TABLE test_table ADD COLUMN column_b TEXT;
ERROR:  must be owner of relation test_table

SET'ing ROLE to scientists doesn't help either (and it shouldn't, because INHERIT)

set role scientists;
ALTER TABLE test_table ADD COLUMN column_b TEXT;
ERROR:  must be owner of relation test_table

What am I missing? Is it even possible to have test_table owned by alice and ALTER'ed by bjork?

4
  • 1
    I think you (also) need alter default privileges in schema public grant all on tables to scientists; otherwise newly created tables won't get the default privileges
    – user330315
    Oct 27, 2017 at 13:36
  • why you just don't create a schema for the user scientists with authorization and put all tables there - then all scientists will have grant to alter the tables. Or alter default privilages on public schema.
    – JustMe
    Oct 27, 2017 at 13:38
  • @a_horse_with_no_name I tried (see edited question where I inserted the statement), it still does not seem to work.
    – psarka
    Oct 27, 2017 at 13:43
  • @JustMe Could you please give a hint on how to alter the privileges? In my real db I do have separate schema, but I am unable to set it up.
    – psarka
    Oct 27, 2017 at 13:45

1 Answer 1

5

You need to SET ROLE before you create the table, so that the role becomes the table owner.

Only the table owner is allowed to ALTER the table.

3
  • So you are saying that there is no way to have test_table owned by alice and ALTER'ed by bjork? Executing SET ROLE before creating table is cumbersome, and I was hoping that scientists would not need to care about such things.
    – psarka
    Oct 27, 2017 at 15:07
  • 1
    Yes, it is like that. Are people really using the database interactively? If not, your application could execute the SET ROLE after login. Oct 29, 2017 at 11:01
  • I see. I will find a way how to deal with the SET ROLE then. Thanks for help!
    – psarka
    Oct 29, 2017 at 19:05

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.