postgresql-revoke 回收權限及刪除角色

回收權限及刪除角色

revoke回收權限

REVOKE [ GRANT OPTION FOR ]
    { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
    [, ...] | ALL [ PRIVILEGES ] }
    ON { [ TABLE ] table_name [, ...]
         | ALL TABLES IN SCHEMA schema_name [, ...] }
    FROM { [ GROUP ] role_name | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

• 刪除用戶

--創建表並賦權限
postgres=#  create schema schema1;
CREATE SCHEMA
postgres=#  set search_path=schema1;
SET
postgres=# create table schema1.test(id int);
CREATE TABLE
postgres=# insert into schema1.test select generate_series(1,10);
INSERT 0 10
postgres=#  create role role_a  with password '123456' login;
CREATE ROLE
postgres=# grant all on database postgres to role_a;
GRANT
postgres=#  grant select on all tables in schema schema1 to role_a;
GRANT
postgres=#  grant all on schema schema1 to role_a;
GRANT

--將前面對象賦權時創建的role_a刪除
postgres=# drop role role_a;
ERROR:  role "role_a" cannot be dropped because some objects depend on it
DETAIL:  privileges for schema schema1
privileges for table test
privileges for database postgres

--刪除role失敗
postgres=# drop role role_a;
ERROR:  role "role_a" cannot be dropped because some objects depend on it
DETAIL:  privileges for schema schema1
privileges for table test
privileges for database postgres

--要想刪除用戶必須回收所有權限
postgres=# revoke all on schema schema1 from role_a;
REVOKE
postgres=# drop role role_a;
ERROR:  role "role_a" cannot be dropped because some objects depend on it
DETAIL:  privileges for table test
privileges for database postgres

postgres=# revoke all on all tables in schema schema1 from role_a;
REVOKE
postgres=# drop role role_a;
ERROR:  role "role_a" cannot be dropped because some objects depend on it
DETAIL:  privileges for database postgres
postgres=# 

postgres=# revoke all on database postgres  from role_a;
REVOKE
postgres=# drop role role_a;
DROP ROLE

刪除用戶前，需要回收權限

• 回收template0的連接權限：

postgres=# revoke connect on database template1 from role_a;
REVOKE
postgres=# \c template1 role_a
psql (9.6.4, server 9.5.3)
You are now connected to database "template1" as user "role_a".

回收template1的連接權限並不生效，控制template1的連接，可以在pg_hba.conf配置，參考前面pg_hba.conf的配置

要刪除一個組角色，執行DROP ROLE group_role命令即可。然而在刪除該組角色之后，它與其成員角色之間的關系將被立即撤銷(成員角色本身不會受影響)。不過需要注意的是，在刪除之前，任何屬於該組角色的對象都必須先被刪除或者將對象的所有者賦予其它角色，與此同時，任何賦予該組角色的權限也都必須被撤消。