Granting ALTER privilege/CREATE specific object to a user in PostgreSQL

152 views Asked by At

I used to work with Oracle, where is obvious to me how to do the thing, but I don't know how to achieve the same functionality in PostgreSQL.

1) Lets say thay USER1 is the OWNER of TEST_TABLE created in schema USER1. I want that USER2 will be able to ALTER user1.test_table(only this privilege, nothing more).

CREATE user1; 
CREATE TABLE test_table(a INT);
CREATE user2;

In Oracle is enough to exeucte as USER1:

GRANT ALTER ON test_table TO user2;

And what about PostgreSQL?

Solution from here doesn't work, because common role will be able to do much more than only ALTER: ALTER postgres table owned by user from the same group

2) How to GRANT TO USER1 privilege to CREATE only specific object in his schema? For example:

As SYS in Oracle:

GRANT CREATE TABLE TO USER1;

Now in Oracle USER1 can only create tables in his schema, not SEQUENCES, VIEWS, etc.

What about Postgres?

GRANT CREATE ON SCHEMA USER1 TO USER1; 

is much more powerfull and I don't need it.

1

There are 1 answers

2
Muhammad Sarmad On

The following is how you can accomplish the feature you mentioned in PostgreSQL:

  1. Assigning Alternate Authority: You must take two steps in order to give USER2 the ability to modify only a single table that USER1 owns. First, give USER2 access to the table's schema by granting them the USAGE privilege, which enables them to view objects in that schema. Second, give USER2 the ALTER privilege on that particular table.

    -- Grant USAGE on schema
    GRANT USAGE ON SCHEMA user1 TO user2;
    
    -- Grant ALTER on the specific table
    GRANT ALTER ON TABLE user1.test_table TO user2;
    

    With this configuration, USER2 is guaranteed the ability to modify the test_table but not further privileges within the schema.

  2. Allowing USER1 to Create Tables Only: Make a different schema for USER1 and make it their default schema in order to allow them to create tables only—not other object kinds, such as sequences or views. Next, provide USER1 access to that schema with the CREATE privilege.

    -- Create a schema for USER1
    CREATE SCHEMA user1;
    
    -- Set USER1's default schema
    ALTER USER user1 SET search_path = user1;
    
    -- Grant CREATE privilege on the schema
    GRANT CREATE ON SCHEMA user1 TO user1;
    

    USER1 is able to construct tables in their schema with this configuration, but they are unable to build additional object kinds such as views or sequences.