In this post, I am sharing a script to find Greenplum user role information with their associated Resource Queue. You can also find other details like type of user and its validity.
We can also use this script to prepare an audit on a list of available users/roles of Greenplum.

SELECT rolname as RoleName
   ,case
	  when rolsuper = 't' then
		   'SUPERUSER'
	  else
		   'NORMAL'
	  end as SuperUser
   ,case
	  when rolcanlogin = 't' then
		   'LOGIN'
	  else
		   'GROUP'
   end as RoleType
   ,rolvaliduntil as RoleValidUntill
   ,rsqname as RQName
FROM pg_roles, gp_toolkit.gp_resqueue_status
WHERE pg_roles.rolresqueue=gp_toolkit.gp_resqueue_status.queueid
order by rolname;

A PostgreSQL Fatal error like role or username does not exist. This is a very common error which is facing by PostgreSQL Users.

Actually, this is happening because of misconfiguration of System username and Database Username.

Most of the Linux users are trying to log in PostgreSQL using root user. But actually, this is wrong.

You will need to become the operating system user under which PostgreSQL was installed to create the first user account.

Generally, the default user name is Postgres and default database is also Postgres.
Once you install PostgreSQL on Linux, you should set the password for the Postgres user which is the default super user of PostgreSQL.

Please do not try to log in with any other default Linux or Unix system user name.

Set password for the default Postgres user:

sudo passwd postgres

Create another role using “postgres”:
Creating new role “dbrnd”. -p = set the password and -d = allow to create database.

sudo -u postgres createuser dbrnd -d -P

PostgreSQL: How to Install PostgreSQL 9.4 on Ubuntu 14.04?

PostgreSQL: How to Install PostgreSQL 9.6 on Ubuntu 16.04?

As a Database Administrator, we are following common practice by creating Database User or Role and assign only require permission to it.

When we are assigning different object level permission to particular Database Role, It is also important check total assigned object to particular Database Role or Which object assigned to which Role/User?

Most of the Database Administrators do not have practice to audit the list of assigned permissions of particular Database User/Role.

It is fine that we are securing database access using specific role, but that is also similarly important to check information about the assigned object and Database Role.
Periodically, Database Administrator should review the list of permissions which assigned to a Database Role/User.

PostgreSQL provides list of system functions for auditing User, Role, and its permissions.

In PostgreSQL, these functions called as Access Privilege Inquiry Functions.
You can find list of functions in this official document.

I have also prepared a small demonstration of this.

First, Create a sample restricted database ROLE:

CREATE ROLE Test_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';

Assign SELECT, INSERT permission on one sample tbl_employees table:

GRANT SELECT,INSERT ON tbl_employees TO Test_User;

Using has_table_privilege(), Script to find list of Users or Roles, who have a INSERT permission on tbl_employees.

SELECT rolname 
FROM pg_roles 
WHERE has_table_privilege(rolname, 'tbl_employees', 'INSERT');

Using pg_has_role(), Script to find list of objects, on which particular User or Role have INSERT permission.

SELECT 
	DISTINCT relname
FROM pg_roles CROSS JOIN pg_class
WHERE pg_has_role('test_user', rolname, 'MEMBER')
	AND has_table_privilege(rolname, pg_class.oid, 'INSERT');

The Database security is always one of the major tasks for all the Database Administrators.
I have also prepared one article to create Read only User in PostgreSQL.

PostgreSQL: Script to Create a Read-Only Database User

In this post, I am sharing small note about REVOKE privileges for newly created Database Users of PostgreSQL.

Before a few days ago, one of the PostgreSQL Junior DBA asked this question on my FB Page. He created one new DB User in PostgreSQL and without giving a any permission that USER can CONNECT to all Databases.

Yes: When you create any new DB User in PostgreSQL, It has a default CONNECT privileges.
But It cannot access any Table or data of Databases, yes It can create new Table in any Database.

To prevent a new User for connecting any existing Database, we should run REVOKE command on particular User or Role.

REVOKE CONNECT privileges from Database:

REVOKE CONNECT ON DATABASE Database_Name FROM User_Name;

REVOKE all privileges from Database:

REVOKE ALL PRIVILEGES ON DATABASE Database_Name FROM User_Name;

You should GRANT only required Databases:

GRANT CONNECT ON DATABASE Database_Name TO User_Name;

Prior to Cassandra 2.2, it supports only User base authentication, but now Cassandra introduces new Role-based authentication.

In this post, I am sharing a demonstration on how to create a Role in Cassandra and How to assign different permissions to that role.
You can directly use this Role for authentication and you can also assign same Role permission to another role.

First, login with Cassandra’s super user.

cqlsh -u cassanddra -p cassandra

Create keyspace if not exists:

CREATE KEYSPACE IF NOT EXISTS dbrnd WITH replication = {'class': 'SimpleStrategy', 'replication_factor' : 3};

USE dbrnd;

Create few sample tables:

CREATE TABLE IF NOT EXISTS tbl_Employee 
(
	EmpID INT PRIMARY KEY
	,EmpFirstName VARCHAR
	,EmpLastName VARCHAR
	,EmpSalary INT
);

CREATE TABLE IF NOT EXISTS tbl_Department
(
	DeptID INT PRIMARY KEY
	,DeptName VARCHAR
);

Create one sample Role without Superuser access:
If you get this error : “org.apache.cassandra.auth.CassandraRoleManager doesn’t support PASSWORD”, visit this solution.

CREATE ROLE ReportingRole WITH PASSWORD = 'pass123' AND LOGIN = true AND SUPERUSER = false;

Grant different permissions to this Role:

GRANT SELECT ON dbrnd.tbl_Employee TO ReportingRole;
GRANT MODIFY ON dbrnd.tbl_Department TO ReportingRole;

If you get any error like ” GRANT operation is not supported by AllowAllAuthorizer”, you have to modify the value of “authorizer” in cassandra.yaml file.

-- Old value:
 authorizer: AllowAllAuthorizer
 
 -- Change to this New value:
 authorizer: org.apache.cassandra.auth.CassandraAuthorizer

Grant over the all keyspaces:

GRANT SELECT ON ALL KEYSPACES TO ReportingRole;
GRANT MODIFY ON ALL KEYSPACES TO ReportingRole;

Create new test Role and make it a replica of the current role:

CREATE ROLE Test WITH PASSWORD = 'pass123' AND LOGIN = true AND SUPERUSER = false;

GRANT ReportingRole to Test;

List out all Roles and its permissions:

-- List out all Roles.
LIST ROLES;
-- List out all permissions of the Role.
LIST ALL PERMISSIONS OF ReportingRole;

In this post, I am sharing the help on how to create, a read-only user with limited access in PostgreSQL Database Server?.

As a Database Administrator, you should create different database users for the different purposes.
In the standard application, there are a few various types of Database Users like Application user, Read-only user, Admin user.

You should always create a shared database role group and assign roles to the user.

Here, I am sharing one script to create the read only user with limited access to PostgreSQL Database. This user can only SELECT table data and also restricted by schema access.

Create the Read-Only user:

CREATE ROLE Read_Only_User WITH LOGIN PASSWORD 'Test1234' 
NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';

Assign permissions to the read only user:

GRANT CONNECT ON DATABASE YourDatabaseName TO Read_Only_User;
GRANT USAGE ON SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO Read_Only_User;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO Read_Only_User;

In the above script, you can find that I restricted user by Database, Schema and gave only SELECT permission for tables.

If you need to give any additional permission like EXECUTE permission for functions, use below script.

GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO Read_Only_User;