patternsqlMajor
Permission denied for relation <table>
Viewed 0 times
permissiondeniedforrelationtable
Problem
I have ran the following SQL in psql:
When I login as
I tried running:
But it doesn't help. What am I doing wrong? Why does database owner NOT have permissions to query its own database?
EDIT:
I upgraded
CREATE USER bspu LOGIN;
CREATE DATABASE bsp OWNER bspu;
GRANT ALL PRIVILEGES ON DATABASE bsp TO bspu;
\c bsp
CREATE TABLE users (
id SERIAL PRIMARY KEY,
client_id VARCHAR(20) NOT NULL,
api_key VARCHAR(100) NOT NULL,
api_secret VARCHAR(100) NOT NULL,
auth_token VARCHAR(128) NOT NULL
);When I login as
bspu, and try to query the users table, I get the error:permission denied for relation usersI tried running:
ALTER DEFAULT PRIVILEGES GRANT ALL ON TABLES TO bspu;But it doesn't help. What am I doing wrong? Why does database owner NOT have permissions to query its own database?
EDIT:
I upgraded
bspu to superuser for now, so I can continue work. Any further guidance appreciated.Solution
DEFAULT PRIVILEGES do not change permissions for existing objects. They are the default privileges for newly created objects and only for the particular role they belong to. If you do not specify the role when running ALTER DEFAULT PRIVILEGES, it defaults to the current role (when executing the ALTER DEFAULT PRIVILEGES statement.Also, since you are using a
serial column, which creates a SEQUENCE, you'll want to set default privileges for sequences as well.Run this on the user you create objects with, before you run the
CREATE command:ALTER DEFAULT PRIVILEGES [ FOR ROLE my_create_role] GRANT ALL ON TABLES TO bspu;
ALTER DEFAULT PRIVILEGES [ FOR ROLE my_create_role] GRANT ALL ON SEQUENCES TO bspu;A word of caution for pgAdmin users. There is a bug in all versions of pgAdmin III and pgAdmin4 (including v5.3). The reverse engineered SQL script for the database or schema nodes displays
DEFAULT PRIVILEGES ignoring the owning user and is therefore incorrect in certain situations. I reported the bug (repeatedly), but the project encountered difficulties fixing it. pgAdmin III was discontinued in favor of pgAdmin4. The bug is still there in pgAdmin4.For existing objects you may also be interested in this "batch" form of the
GRANT command:GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO bspu;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO bspu;More under this related question on SO:
- Grant all on a specific schema in the db to a group role in PostgreSQL
Code Snippets
ALTER DEFAULT PRIVILEGES [ FOR ROLE my_create_role] GRANT ALL ON TABLES TO bspu;
ALTER DEFAULT PRIVILEGES [ FOR ROLE my_create_role] GRANT ALL ON SEQUENCES TO bspu;GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO bspu;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO bspu;Context
StackExchange Database Administrators Q#53914, answer score: 47
Revisions (0)
No revisions yet.