碼上快樂

相關內容    簡體    繁體

postgresql role(角色)

本文轉載自   查看原文   2022-03-01 15:50   718    Postgresql

在PG中,角色與用戶的概念比較模糊,可以認為帶LOGIN屬性的role就是用戶. #創建role

帶了login屬性.就可以登錄數據庫.

  1.  
    postgres= # create role role1;
  2.  
    CREATE ROLE
  3.  
    postgres= # \c - role1
  4.  
    FATAL: role "role1" is not permitted to log in
  5.  
    Previous connection kept
  6.  
    postgres= # alter role role1 login;
  7.  
    ALTER ROLE
  8.  
    postgres= # \c - role1
  9.  
    You are now connected to database "postgres" as user "role1".

create user role1 與create role role1 login 是等價的,避免混淆,我只記create role方式.

role的系統視圖是pg_roles

  1.  
    postgres => select rolname,rolsuper,rolcanlogin from pg_roles;
  2.  
    rolname | rolsuper | rolcanlogin
  3.  
    ----------+----------+-------------
  4.  
    postgres | t | t
  5.  
    hippo | f | t
  6.  
    user2 | f | t
  7.  
    user1 | t | t
  8.  
    role1 | f | t

在使用initdb初始化cluster時,默認會創建一個superuser,名字是將執行initdb命令的操作系統用戶一樣的用戶,通常叫postgres
命令行工具如psql,pg_dump等都需要指定連接用戶及連接數據庫.默認用戶是操作系統用戶,默認數據庫名字跟連接用戶名保持一致.

指定數據庫名字

  1.  
    [postgres@fnddb ~]$ psql -d database1
  2.  
    psql ( 9.4.1)
  3.  
    Type "help" for help.
  4.  
     
  5.  
    database1= # \c
  6.  
    You are now connected to database "database1" as user "postgres".

指定用戶名

  1.  
    [postgres @fnddb ~]$ psql -U role1 --不指定數據庫名字,默認數據庫跟用戶名一致,所以找不到
  2.  
    psql: FATAL: database "role1" does not exist

role屬性

可以認為是這個用戶所具有的系統權限.

  • LOGIN --具有登錄權限
  • SUPERUSER --超級用戶,具有所有系統權限,除了登錄驗證
  • CREATEDB --創建數據庫權限
  • CREATEROLE --創建role權限
  • PASSWORD --設置密碼

修改屬性

  1.  
    postgres =# create role role2 login;
  2.  
    CREATE ROLE
  3.  
     
  4.  
    postgres =# select * from pg_user where usename = 'role2';
  5.  
    usename | usesysid | usecreatedb | usesuper | usecatupd | userepl | passwd | valuntil | useconfig
  6.  
    ---------+----------+-------------+----------+-----------+---------+----------+----------+-----------
  7.  
    role2 | 16494 | f | f | f | f | ******** | |
  8.  
    (1 row)
  9.  
     
  10.  
    postgres =# alter role role2 createdb createrole password 'rolepasswd';
  11.  
    ALTER ROLE
  12.  
    postgres =# \du role2
  13.  
    List of roles
  14.  
    Role name | Attributes | Member of
  15.  
    -----------+------------------------+-----------
  16.  
    role2 | Create role, Create DB | {}
  17.  
     
  18.  
    postgres =# alter role role2 nocreatedb nocreaterole superuser;
  19.  
    ALTER ROLE
  20.  
    postgres =# \du role2
  21.  
    List of roles
  22.  
    Role name | Attributes | Member of
  23.  
    -----------+------------+-----------
  24.  
    role2 | Superuser | {}

#role的參數 可以修改用戶的參數,來影響某用戶操作數據庫的特殊行為.這部分在講服務器參數修改時已提及.

  1.  
    postgres =# alter role role2 set enable_indexscan = f;
  2.  
    ALTER ROLE

#role membership(role 成員) 為了管理上的方便,我們可以創建一個role group,然后可以將各用戶或者有特殊權限的role組織在一起,各個role就是這個role group的membership.
role group 是不帶login的role,因為pg使用role來表示所有的角色,用戶,用戶組,所以不要混淆,創建語句都是create role.我們來測試一下.

我們創建一個用戶,兩個角色,分別有直屬一個表的查詢權限

  1.  
    postgres =# create role jack login inherit;
  2.  
    CREATE ROLE
  3.  
    postgres =# create role r1;
  4.  
    CREATE ROLE
  5.  
    postgres =# create role r2;
  6.  
    CREATE ROLE
  7.  
    postgres =# \c database1
  8.  
    You are now connected to database "database1" as user "postgres".
  9.  
    database1 =# create table tab1(id text);
  10.  
    CREATE TABLE
  11.  
    database1 =# create table tab2(id text);
  12.  
    CREATE TABLE
  13.  
    database1 =# create table tab3 (id text);
  14.  
    CREATE TABLE
  15.  
    database1 =# grant select on tab1 to r1;
  16.  
    GRANT
  17.  
    database1 =# grant select on tab2 to r2;
  18.  
    GRANT
  19.  
    database1 =# grant select on tab3 to jack;
  20.  
    GRANT

進行grant授權,使jack成為r1,r2的membership

  1.  
    database1 =# grant r1 to jack;
  2.  
    GRANT ROLE
  3.  
    database1 =# grant r2 to jack;
  4.  
    GRANT ROLE
  5.  
    database1 =# grant usage on schema public to public; --授權usage給所有用戶(后一個public),否則看不到數據庫中的表.
  6.  
    GRANT

測試角色切換

jack繼承了r1,r2的權限

  1.  
    database1 =# \c - jack
  2.  
    You are now connected to database "database1" as user "jack".
  3.  
    database1 => select * from tab3;
  4.  
    id
  5.  
    ----
  6.  
    ( 0 rows)
  7.  
     
  8.  
    database1 => select * from tab1;
  9.  
    id
  10.  
    ----
  11.  
    ( 0 rows)
  12.  
     
  13.  
    database1 => select * from tab2;
  14.  
    id
  15.  
    ----
  16.  
    ( 0 rows)

間接繼承的也可以

  1.  
    database1 => \c - postgres
  2.  
    You are now connected to database "database1" as user "postgres".
  3.  
    database1 =# revoke r2 from jack;
  4.  
    REVOKE ROLE
  5.  
    database1 =# grant r2 to r1;
  6.  
    GRANT ROLE
  7.  
    database1 =# \c - jack;
  8.  
    You are now connected to database "database1" as user "jack".
  9.  
    database1 => select * from tab2;
  10.  
    id
  11.  
    ----
  12.  
    ( 0 rows)

關閉r1的繼承

  1.  
    database1 => \c - postgres
  2.  
    You are now connected to database "database1" as user "postgres".
  3.  
    database1 =# alter role r1 noinherit;
  4.  
    ALTER ROLE
  5.  
    database1 =# \c - jack;
  6.  
    You are now connected to database "database1" as user "jack".
  7.  
    database1 => select * from tab2; --已經查詢不了r2的權限
  8.  
    ERROR: permission denied for relation tab2
  9.  
    database1 => select * from tab1;
  10.  
    id
  11.  
    ----
  12.  
    ( 0 rows)

直接切換到r2角色,你已經不是jack了:)

  1.  
    database1 => set role r1;
  2.  
    SET
  3.  
    database1 => select * from tab1;
  4.  
    id
  5.  
    ----
  6.  
    ( 0 rows)
  7.  
     
  8.  
    database1 => select * from tab2;
  9.  
    ERROR: permission denied for relation tab2
  10.  
    database1 => select * from tab3;
  11.  
    ERROR: permission denied for relation tab3

授權不能形成回路

  1.  
    database1=> \c - postgres
  2.  
    You are now connected to database "database1" as user "postgres".
  3.  
    database1= # \du
  4.  
    List of roles
  5.  
    Role name | Attributes | Member of
  6.  
    -----------+------------------------------------------------+-----------
  7.  
    hippo | | {}
  8.  
    jack | | {r1}
  9.  
    postgres | Superuser, Create role, Create DB, Replication | {}
  10.  
    r1 | No inheritance, Cannot login | {r2}
  11.  
    r2 | Cannot login | {}
  12.  
    user1 | Superuser, Create role, Create DB | {}
  13.  
    user2 | Create DB | {}
  14.  
     
  15.  
    database1= # grant jack to r2;
  16.  
    ERROR: role "jack" is a member of role "r2"

系統權限任何時候都不會繼承,只有主動set過去才生效

  1.  
    database1 =# alter role r1 createrole;
  2.  
    ALTER ROLE
  3.  
    database1 =# \c - jack;
  4.  
    You are now connected to database "database1" as user "jack".
  5.  
    database1 => create role jacktest1;
  6.  
    ERROR: permission denied to create role
  7.  
    database1 => set role r1;
  8.  
    SET
  9.  
    database1 => create role jacktest1;
  10.  
    CREATE ROLE

三種方式還原到最初的jack角色

  1.  
    database1 => set role jack;
  2.  
    SET
  3.  
    database1 => set role none;
  4.  
    SET
  5.  
    database1 => reset role;
  6.  
    RESET

#角色刪除

在什么角色下建的對象,歸屬於哪個角色,而非登錄者

  1.  
    database1 => \c - postgres
  2.  
    You are now connected to database "database1" as user "postgres".
  3.  
    database1 =# grant create on database database1 to r1;
  4.  
    GRANT
  5.  
    database1 =# \c - jack
  6.  
    You are now connected to database "database1" as user "jack".
  7.  
    database1 => set role r1;
  8.  
    SET
  9.  
    database1 => create table tab4(id text);
  10.  
    CREATE TABLE
  11.  
    database1 => \dt tab4 --這里要注意:owner變成了r1而不是jack
  12.  
    List of relations
  13.  
    Schema | Name | Type | Owner
  14.  
    --------+------+-------+-------
  15.  
    public | tab4 | table | r1
  16.  
    ( 1 row)

刪除role,role下有權限或者是對象屬於此role,則刪除不了

  1.  
    database1 => \c - postgres
  2.  
    You are now connected to database "database1" as user "postgres".
  3.  
    database1 =# drop role r1;
  4.  
    ERROR: role "r1" cannot be dropped because some objects depend on it
  5.  
    DETAIL: owner of table tab4
  6.  
    privileges for database database1
  7.  
    privileges for table tab1

移除掉相關權限關聯后進行刪除

  1.  
    database1 =# drop table tab1;
  2.  
    DROP TABLE
  3.  
    database1 =# drop table tab4;
  4.  
    DROP TABLE
  5.  
    database1 =# revoke create on database database1 from r1;
  6.  
    REVOKE
  7.  
    database1 =# drop role r1;
  8.  
    DROP ROLE

涉及到r1的成員或者是角色租(role group) 自動釋放

  1.  
    database1 =# \du
  2.  
    List of roles
  3.  
    Role name | Attributes | Member of
  4.  
    -----------+------------------------------------------------+-----------
  5.  
    hippo | | {}
  6.  
    jack | | {}
  7.  
    jacktest1 | Cannot login | {}
  8.  
    postgres | Superuser, Create role, Create DB, Replication | {}
  9.  
    r2 | Cannot login | {}
  10.  
    user1 | Superuser, Create role, Create DB | {}
  11.  
    user2 | Create DB | {}

#ROLE總結

  1. PG中的role包含了用戶,角色,角色組,成員等所有含義.都使用create role來創建.
  2. 一個role可以成為多個role的成員,根據role的inherit屬性來決定是否集成其他role的各種權限
  3. 繼承關系不能形成回路.
  4. role上的屬性如createdb,createrole不會直接繼承,需要顯式通過set role切換過去.
  5. 刪除role需要先清理此role關聯的各種權限.

//END

 

轉載於:https://my.oschina.net/hippora/blog/376733


免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。



猜您在找 MySQL角色（Role）功能介紹 MySQL角色(role)功能介紹 Ansible_創建角色_role postgresql 角色權限 PostgreSQL角色和權限 PostgreSQL 角色管理 設計模式之美：Role Object（角色對象） 自學Aruba5.1-Aruba 基於角色(role)的策略管理（重點） 基於角色的權限控制系統（role-based access control） asp.net Identity2 角色(Role)的使用（一）初始配置
 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM