<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>pg_has_role() &#8211; Database Research &amp; Development</title>
	<atom:link href="https://www.dbrnd.com/tag/pg_has_role/feed/" rel="self" type="application/rss+xml" />
	<link>https://www.dbrnd.com</link>
	<description>BIGData &#124; NoSQL &#124; MSSQL &#124; MySQL &#124; PostgreSQL</description>
	<lastBuildDate>Sun, 02 Oct 2016 18:29:57 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0.6</generator>
	<item>
		<title>PostgreSQL: Find which object assigns to which user or role and vice versa</title>
		<link>https://www.dbrnd.com/2016/10/postgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list/</link>
		
		<dc:creator><![CDATA[Anvesh Patel]]></dc:creator>
		<pubDate>Wed, 05 Oct 2016 16:16:25 +0000</pubDate>
				<category><![CDATA[PostgreSQL]]></category>
		<category><![CDATA[access privileges]]></category>
		<category><![CDATA[Anvesh Patel]]></category>
		<category><![CDATA[database]]></category>
		<category><![CDATA[database research and development]]></category>
		<category><![CDATA[dbrnd]]></category>
		<category><![CDATA[GRANT]]></category>
		<category><![CDATA[has_table_privilege()]]></category>
		<category><![CDATA[object permission]]></category>
		<category><![CDATA[permission]]></category>
		<category><![CDATA[pg_has_role()]]></category>
		<category><![CDATA[plpgsql]]></category>
		<category><![CDATA[Postgres Query]]></category>
		<category><![CDATA[postgresql]]></category>
		<category><![CDATA[PostgreSQL Administrator]]></category>
		<category><![CDATA[PostgreSQL Error]]></category>
		<category><![CDATA[PostgreSQL Programming]]></category>
		<category><![CDATA[PostgreSQL Tips and Tricks]]></category>
		<category><![CDATA[REVOKE]]></category>
		<category><![CDATA[role]]></category>
		<category><![CDATA[user]]></category>
		<guid isPermaLink="false">https://www.dbrnd.com/?p=3699</guid>

					<description><![CDATA[As a Database Administrator, we are following common practice by creating Database User or Role and assign only require permission to it. When we are assigning different object level permission to particular Database Role, It is also important check total assigned object to particular Database Role or Which object assigned to which Role/User? Most of [&#8230;]]]></description>
										<content:encoded><![CDATA[<p><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fwww.dbrnd.com%2F2016%2F10%2Fpostgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list%2F&amp;linkname=PostgreSQL%3A%20Find%20which%20object%20assigns%20to%20which%20user%20or%20role%20and%20vice%20versa" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fwww.dbrnd.com%2F2016%2F10%2Fpostgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list%2F&amp;linkname=PostgreSQL%3A%20Find%20which%20object%20assigns%20to%20which%20user%20or%20role%20and%20vice%20versa" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fwww.dbrnd.com%2F2016%2F10%2Fpostgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list%2F&amp;linkname=PostgreSQL%3A%20Find%20which%20object%20assigns%20to%20which%20user%20or%20role%20and%20vice%20versa" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_pinterest" href="https://www.addtoany.com/add_to/pinterest?linkurl=https%3A%2F%2Fwww.dbrnd.com%2F2016%2F10%2Fpostgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list%2F&amp;linkname=PostgreSQL%3A%20Find%20which%20object%20assigns%20to%20which%20user%20or%20role%20and%20vice%20versa" title="Pinterest" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fwww.dbrnd.com%2F2016%2F10%2Fpostgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list%2F&amp;linkname=PostgreSQL%3A%20Find%20which%20object%20assigns%20to%20which%20user%20or%20role%20and%20vice%20versa" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_pocket" href="https://www.addtoany.com/add_to/pocket?linkurl=https%3A%2F%2Fwww.dbrnd.com%2F2016%2F10%2Fpostgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list%2F&amp;linkname=PostgreSQL%3A%20Find%20which%20object%20assigns%20to%20which%20user%20or%20role%20and%20vice%20versa" title="Pocket" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share#url=https%3A%2F%2Fwww.dbrnd.com%2F2016%2F10%2Fpostgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list%2F&#038;title=PostgreSQL%3A%20Find%20which%20object%20assigns%20to%20which%20user%20or%20role%20and%20vice%20versa" data-a2a-url="https://www.dbrnd.com/2016/10/postgresql-find-which-object-assigns-to-which-user-or-role-and-audit-user-role-assigned-object-list/" data-a2a-title="PostgreSQL: Find which object assigns to which user or role and vice versa"></a></p><p>As a Database Administrator, we are following common practice by creating Database User or Role and assign only require permission to it. </p>
<blockquote><p>When we are assigning different object level permission to particular Database Role, It is also important check total assigned object to particular Database Role or Which object assigned to which Role/User?</p></blockquote>
<blockquote><p>Most of the Database Administrators do not have practice to audit the list of assigned permissions of particular Database User/Role. </p></blockquote>
<blockquote><p>It is fine that we are securing database access using specific role, but that is also similarly important to check information about the assigned object and Database Role.<br />
Periodically, Database Administrator should review the list of permissions which assigned to a Database Role/User.</p></blockquote>
<blockquote><p>PostgreSQL provides list of system functions for auditing User, Role, and its permissions.</p></blockquote>
<p>In PostgreSQL, these functions called as Access Privilege Inquiry Functions.<br />
<a href="https://www.postgresql.org/docs/9.1/static/functions-info.html" target="_blank">You can find list of functions in this official document. </a></p>
<p>I have also prepared a small demonstration of this.</p>
<p><strong>First, Create a sample restricted database ROLE:</strong></p>
<pre class="crayon-plain-tag">CREATE ROLE Test_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';</pre> </p>
<p><strong>Assign SELECT, INSERT permission on one sample tbl_employees table:</strong></p>
<pre class="crayon-plain-tag">GRANT SELECT,INSERT ON tbl_employees TO Test_User;</pre> </p>
<p><strong>Using has_table_privilege(), Script to find list of Users or Roles, who have a INSERT permission on tbl_employees. </strong></p>
<pre class="crayon-plain-tag">SELECT rolname 
FROM pg_roles 
WHERE has_table_privilege(rolname, 'tbl_employees', 'INSERT');</pre> </p>
<p><strong>Using pg_has_role(), Script to find list of objects, on which particular User or Role have INSERT permission. </strong></p>
<pre class="crayon-plain-tag">SELECT 
	DISTINCT relname
FROM pg_roles CROSS JOIN pg_class
WHERE pg_has_role('test_user', rolname, 'MEMBER')
	AND has_table_privilege(rolname, pg_class.oid, 'INSERT');</pre> </p>
]]></content:encoded>
					
		
		
			</item>
	</channel>
</rss>
