PostgreSQL：訪問其他用戶擁有的表

Question

我在同一模式下從postgreSql中的超級用戶創建了兩個角色。

1）read_only_with_create_view
2）READ_WRITE

然後，我已經創建了兩個用戶從每個角色。 （read_only_with_create_view_user和read_write）

現在由read_only_with_create_view_user創建的任何新視圖都不能由read_write_user作爲視圖的所有者（read_only_with_create_view_user）訪問。

那麼通過read_write_user訪問所有新視圖的方式是什麼？

基本上我試圖實現的是一個用戶創建的所有東西都應該可以被其他用戶訪問。

我的步驟如下：

CREATE ROLE read_only_role WITH 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity'; 

GRANT CONNECT ON DATABASE mydb to read_only_role; 
GRANT USAGE,CREATE ON SCHEMA myschema TO read_only_role; 
GRANT SELECT ON ALL TABLES IN SCHEMA myschema TO read_only_role; 
GRANT SELECT ON ALL SEQUENCES IN SCHEMA myschema TO read_only_role; 

CREATE USER read_only_with_create_view_user 
WITH PASSWORD '*****' 
in ROLE read_only_role; 

-- Now created new views using this role. That means read_only_with_create_view_user is owner of those views. 

-- Creating new read-write role. 

CREATE ROLE rw_role WITH 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity' IN ROLE read_only_role; 

GRANT CONNECT ON DATABASE mydb to rw_role; 

GRANT USAGE ON SCHEMA myschema TO crn_rw_role_qa; 
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA myschema TO rw_role; 
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA myschema TO rw_role; 

CREATE USER read_write_user 
WITH PASSWORD '*****' 
in role rw_role; 

So after login with read_write_user when I try to access new views created by read_only_with_create_view_user, I get below error 


ERROR: permission denied for relation view_name 
********** Error ********** 

ERROR: permission denied for relation view_name 
SQL state: 42501 

感謝，
人士Himanshu

Answer 1

您可以設置角色的其他角色的成員：

GRANT read_only_with_create_view_user TO read_write_user; 

更多信息here。

---

編輯

，你期望它永遠不會工作。請參閱您的當前用戶的模式：

角色read_write_user將無法​​訪問由read_only_with_create_view_user擁有的僅僅是因爲雙方沒有任何關係的對象。要做到這一點，您必須將對象所有權重新分配給「上層」角色：read_only_role（因爲每個人都是此角色的成員）。

您可以執行下列操作之一：

--Connected as read_only_with_create_view_user 
CREATE VIEW my_view AS SELECT 1; 

--Assign ownership to top-level role 
ALTER VIEW my_view OWNER TO read_only_role; 

或者你可能更喜歡這種方法：

--Connected as read_only_with_create_view_user 
--Change current user to read_only_role 
SET role = read_only_role; 

--Create a view... 
CREATE VIEW my_view AS SELECT 1; 

--Turn back to read_only_with_create_view_user 
RESET role; 

您還可以，當然，直接授予權限的對象。

CREATE VIEW my_view_2 AS SELECT 1; 
GRANT SELECT ON my_view_2 TO read_write_user 

如果你喜歡做一次，你可以在短短一個命令重新分配由read_only_with_create_view_user擁有的頂層角色對象的所有權：

REASSIGN OWNED BY read_only_with_create_view_user TO read_only_role;