當前位置：首頁 > 运维知识 > 数据库 >内容正文

数据库

查看pg　用户组_PostgreSQL 角色用户管理

發布時間：2024/3/12 数据库 65 豆豆

生活随笔收集整理的這篇文章主要介紹了查看pg　用户组_PostgreSQL 角色用户管理小編覺得挺不錯的,現在分享給大家,幫大家做個參考.

一、角色與用戶的區別

PostgreSQL使用角色的概念管理數據庫訪問權限。根據角色自身的設置不同，一個角色可以看做是一個數據庫用戶，或者一組數據庫用戶。角色可以擁有數據庫對象(比如表)以及可以把這些對象上的權限賦予其它角色，以控制誰擁有訪問哪些對象的權限。

其實用戶和角色都是角色，只是用戶是具有登錄權限的角色。

在PostgreSQL 里沒有區分用戶和角色的概念，"CREATE USER" 為 "CREATE ROLE" 的別名，這兩個命令幾乎是完全相同的，唯一的區別是"CREATE USER" 命令創建的用戶默認帶有LOGIN屬性，而"CREATE ROLE" 命令創建的用戶默認不帶LOGIN屬性(CREATE USER is equivalent to CREATE ROLE except that CREATE USER assumes LOGIN by default, while CREATE ROLE does not)。

1.1 創建角色與用戶

CREATE ROLE 語法

CREATE ROLE name [ [ WITH ] option [ ... ] ]

where option can be:

SUPERUSER | NOSUPERUSER

| CREATEDB | NOCREATEDB

| CREATEROLE | NOCREATEROLE

| CREATEUSER | NOCREATEUSER

| INHERIT | NOINHERIT

| LOGIN | NOLOGIN

| REPLICATION | NOREPLICATION

| CONNECTION LIMIT connlimit

| [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password'

| VALID UNTIL 'timestamp'

| IN ROLE role_name [, ...]

| IN GROUP role_name [, ...]

| ROLE role_name [, ...]

| ADMIN role_name [, ...]

| USER role_name [, ...]

| SYSID uid

創建david 角色和sandy 用戶

postgres=# CREATE ROLE david;　　//默認不帶LOGIN屬性

CREATE ROLE

postgres=# CREATE USER sandy;　　//默認具有LOGIN屬性

CREATE ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

david | Cannot login | {}

postgres | Superuser, Create role, Create DB, Replication | {}

sandy | | {}

postgres=#

postgres=# SELECT rolname from pg_roles ;

rolname

----------

postgres

david

sandy

(3 rows)

postgres=# SELECT usename from pg_user; //角色david 創建時沒有分配login權限，所以沒有創建用戶

usename

----------

postgres

sandy

(2 rows)

postgres=#

1.2 驗證LOGIN屬性

postgres@CS-DEV:~> psql -U david

psql: FATAL: role "david" is not permitted to log in

postgres@CS-DEV:~> psql -U sandy

psql: FATAL: database "sandy" does not exist

postgres@CS-DEV:~> psql -U sandy -d postgres

psql (9.1.0)

Type "help" for help.

postgres=> \dt

No relations found.

postgres=>

用戶sandy 可以登錄，角色david 不可以登錄。

1.3 修改david 的權限，增加LOGIN權限

postgres=# ALTER ROLE david LOGIN ;

ALTER ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

sandy | | {}

postgres=# SELECT rolname from pg_roles ;

rolname

----------

postgres

sandy

david

(3 rows)

postgres=# SELECT usename from pg_user;　　//給david 角色分配login權限，系統將自動創建同名用戶david

usename

----------

postgres

sandy

david

(3 rows)

postgres=#

1.4 再次驗證LOGIN屬性

postgres@CS-DEV:~> psql -U david -d postgres

Type "help" for help.

postgres=> \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

sandy | | {}

postgres=>

david 現在也可以登錄了。

二、查看角色信息

psql 終端可以用\du 或\du+ 查看，也可以查看系統表 select * from pg_roles;

postgres=> \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

david | Cannot login | {}

postgres | Superuser, Create role, Create DB, Replication | {}

sandy | | {}

postgres=> \du+

List of roles

Role name | Attributes | Member of | Description

-----------+------------------------------------------------+-----------+-------------

david | Cannot login | {} |

postgres | Superuser, Create role, Create DB, Replication | {} |

sandy | | {} |

postgres=> SELECT * from pg_roles;

----------+----------+------------+---------------+-------------+--------------+-------------+----------------+--------------+-------------+---------------+-----------+-------

postgres | t | t | t | t | t | t | t | -1 | ******** | | | 10

david | f | t | f | f | f | f | f | -1 | ******** | | | 49438

sandy | f | t | f | f | f | t | f | -1 | ******** | | | 49439

(3 rows)

postgres=>

三、角色屬性(Role Attributes)

一個數據庫角色可以有一系列屬性，這些屬性定義了他的權限。

屬性說明login只有具有 LOGIN 屬性的角色可以用做數據庫連接的初始角色名

superuser數據庫超級用戶

createdb創建數據庫權限

createrole允許其創建或刪除其他普通的用戶角色(超級用戶除外)

replication做流復制的時候用到的一個用戶屬性，一般單獨設定。

password在登錄時要求指定密碼時才會起作用，比如md5或者password模式，跟客戶端的連接認證方式有關

inherit用戶組對組員的一個繼承標志，成員可以繼承用戶組的權限特性

四、創建用戶時賦予角色屬性

從pg_roles 表里查看到的信息，在上面創建的david 用戶時，默認沒有創建數據庫等權限。

postgres@CS-DEV:~> psql -U david -d postgres

Type "help" for help.

postgres=> \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

sandy | | {}

postgres=> CREATE DATABASE test;

ERROR: permission denied to create database

postgres=>

如果要在創建角色時就賦予角色一些屬性，可以使用下面的方法。

首先切換到postgres 用戶。

4.1 創建角色bella 并賦予其CREATEDB 的權限。

postgres=# CREATE ROLE bella CREATEDB ;

CREATE ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB, Cannot login | {}

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

sandy | | {}

postgres=#

4.2 創建角色renee 并賦予其創建數據庫及帶有密碼登錄的屬性。

postgres=# CREATE ROLE renee CREATEDB PASSWORD 'abc123' LOGIN;

CREATE ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB, Cannot login | {}

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

renee | Create DB | {}

sandy | | {}

postgres=#

4.3 測試renee 角色

a. 登錄

postgres@CS-DEV:~> psql -U renee -d postgres

Type "help" for help.

postgres=>

用renee 用戶登錄數據庫，發現不需要輸入密碼既可登錄，不符合實際情況。

b. 查找原因

在角色屬性中關于password的說明，在登錄時要求指定密碼時才會起作用，比如md5或者password模式，跟客戶端的連接認證方式有關。

查看pg_hba.conf 文件，發現local 的METHOD 為trust，所以不需要輸入密碼。

將local 的METHOD 更改為password，然后保存重啟postgresql。

五、給已存在用戶賦予各種權限

使用ALTER ROLE 命令。

ALTER ROLE 語法：

ALTER ROLE name [ [ WITH ] option [ ... ] ]

where option can be:

SUPERUSER | NOSUPERUSER

| CREATEDB | NOCREATEDB

| CREATEROLE | NOCREATEROLE

| CREATEUSER | NOCREATEUSER

| INHERIT | NOINHERIT

| LOGIN | NOLOGIN

| REPLICATION | NOREPLICATION

| CONNECTION LIMIT connlimit

| [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password'

| VALID UNTIL 'timestamp'

ALTER ROLE name RENAME TO new_name

ALTER ROLE name [ IN DATABASE database_name ] SET configuration_parameter { TO | = } { value | DEFAULT }

ALTER ROLE name [ IN DATABASE database_name ] SET configuration_parameter FROM CURRENT

ALTER ROLE name [ IN DATABASE database_name ] RESET configuration_parameter

ALTER ROLE name [ IN DATABASE database_name ] RESET ALL

5.1 賦予bella 登錄權限

a. 查看現在的角色屬性

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB, Cannot login | {}

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

renee | Create DB | {}

sandy | | {}

postgres=#

b. 賦予登錄權限

postgres=# ALTER ROLE bella WITH LOGIN;

ALTER ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB | {}

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

renee | Create DB | {}

sandy | | {}

postgres=#

5.2 賦予renee 創建角色的權限

postgres=# ALTER ROLE renee WITH CREATEROLE;

ALTER ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB | {}

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

renee | Create role, Create DB | {}

sandy | | {}

postgres=#

5.3 賦予david 帶密碼登錄權限

postgres=# ALTER ROLE david WITH PASSWORD 'ufo456';

ALTER ROLE

postgres=#

5.4 設置sandy 角色的有效期

postgres=# ALTER ROLE sandy VALID UNTIL '2019-04-24';

ALTER ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB | {}

david | | {}

postgres | Superuser, Create role, Create DB, Replication | {}

renee | Create role, Create DB | {}

sandy | | {}

postgres=# SELECT * from pg_roles ;

----------+----------+------------+---------------+-------------+--------------+-------------+----------------+--------------+-------------+------------------------+-----------+-------

postgres | t | t | t | t | t | t | t | -1 | ******** | | | 10

bella | f | t | f | t | f | t | f | -1 | ******** | | | 49440

renee | f | t | t | t | f | t | f | -1 | ******** | | | 49442

david | f | t | f | f | f | t | f | -1 | ******** | | | 49438

sandy | f | t | f | f | f | t | f | -1 | ******** | 2019-04-24 00:00:00+08 | | 49439

(5 rows)

postgres=#

六、角色賦權/角色成員

在系統的角色管理中，通常會把多個角色賦予一個組，這樣在設置權限時只需給該組設置即可，撤銷權限時也是從該組撤銷。在PostgreSQL中，首先需要創建一個代表組的角色，之后再將該角色的membership 權限賦給獨立的角色即可。

6.1 創建組角色

postgres=# CREATE ROLE father login nosuperuser nocreatedb nocreaterole noinherit encrypted password 'abc123';

CREATE ROLE

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB | {}

david | | {}

father | No inheritance | {}

postgres | Superuser, Create role, Create DB, Replication | {}

renee | Create role, Create DB | {}

sandy | | {}

postgres=#

6.2 給father 角色賦予數據庫test 連接權限和相關表的查詢權限。

postgres=# GRANT CONNECT ON DATABASE test to father;

GRANT

postgres=# \c test renee

You are now connected to database "test" as user "renee".

test=> \dt

No relations found.

test=> CREATE TABLE emp (

test(> id serial,

test(> name text);

NOTICE: CREATE TABLE will create implicit sequence "emp_id_seq" for serial column "emp.id"

CREATE TABLE

test=> INSERT INTO emp (name) VALUES ('david');

INSERT 0 1

test=> INSERT INTO emp (name) VALUES ('sandy');

INSERT 0 1

test=> SELECT * from emp;

id | name

----+-------

1 | david

2 | sandy

(2 rows)

test=> \dt

List of relations

Schema | Name | Type | Owner

--------+------+-------+-------

public | emp | table | renee

(1 row)

test=> GRANT USAGE ON SCHEMA public to father;

WARNING: no privileges were granted for "public"

GRANT

test=> GRANT SELECT on public.emp to father;

GRANT

test=>

6.3 創建成員角色

test=> \c postgres postgres

You are now connected to database "postgres" as user "postgres".

postgres=# CREATE ROLE son1 login nosuperuser nocreatedb nocreaterole inherit encrypted password 'abc123';

CREATE ROLE

postgres=#

這里創建了son1 角色，并開啟inherit 屬性。PostgreSQL 里的角色賦權是通過角色繼承(INHERIT)的方式實現的。

6.4 將father 角色賦給son1

postgres=# GRANT father to son1;

GRANT ROLE

postgres=#

還有另一種方法，就是在創建用戶的時候賦予角色權限。

postgres=# CREATE ROLE son2 login nosuperuser nocreatedb nocreaterole inherit encrypted password 'abc123' in role father;

CREATE ROLE

postgres=#

6.5 測試son1 角色

postgres=# \c test son1

You are now connected to database "test" as user "son1".

test=> \dt

List of relations

Schema | Name | Type | Owner

--------+------+-------+-------

public | emp | table | renee

(1 row)

test=> SELECT * from emp;

id | name

----+-------

1 | david

2 | sandy

(2 rows)

test=>

用renee 角色新創建一張表，再次測試

test=> \c test renee

You are now connected to database "test" as user "renee".

test=> CREATE TABLE dept (

test(> deptid integer,

test(> deptname text);

CREATE TABLE

test=> INSERT INTO dept (deptid, deptname) values(1, 'ts');

INSERT 0 1

test=> \c test son1

You are now connected to database "test" as user "son1".

test=> SELECT * from dept ;

ERROR: permission denied for relation dept

test=>

son1 角色只能查詢emp 表的數據，而不能查詢dept 表的數據，測試成功。

6.6 查詢角色組信息

test=> \c postgres postgres

You are now connected to database "postgres" as user "postgres".

postgres=#

postgres=# \du

List of roles

Role name | Attributes | Member of

-----------+------------------------------------------------+-----------

bella | Create DB | {}

david | | {}

father | No inheritance | {}

postgres | Superuser, Create role, Create DB, Replication | {}

renee | Create role, Create DB | {}

sandy | | {}

son1 | | {father}

son2 | | {father}

postgres=#

"Member of " 項表示son1 和son2 角色屬于father 角色組。

6.7 對整個schema的對象進行權限管理

PostgreSQL 從9.0開始就提供了比較方便的對整個schema的指定對象賦權給目標用的語法。

GRANT

例子

GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }

[, ...] | ALL [ PRIVILEGES ] }

ON { [ TABLE ] table_name [, ...]

| ALL TABLES IN SCHEMA schema_name [, ...] }

TO role_specification [, ...] [ WITH GRANT OPTION ]

REVOKE [ GRANT OPTION FOR ]

{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }

[, ...] | ALL [ PRIVILEGES ] }

ON { [ TABLE ] table_name [, ...]

| ALL TABLES IN SCHEMA schema_name [, ...] }

FROM { [ GROUP ] role_name | PUBLIC } [, ...]

[ CASCADE | RESTRICT ]

將schema digoal下的所有表的select,update權限賦予給test用戶。

注意

如果digoal.*中包含了非當前用戶的表，并且當前用戶非超級用戶，并且當前用戶沒有這些表的select,update的with grant option權限。將報錯。

換句話說，如果要確保這個賦權操作萬無一失，可以選擇使用超級用戶來執行。

grant select,update on all tables in schema digoal to test;

將schema digoal下的所有表的select,update權限從test用戶回收。

revoke select,update on all tables in schema digoal from test;

在對整個schema下的所有對象的權限管理完后，別忘記了在對象之上，還需要對schema、database、instance進行相應的賦權。

6.8 如何設置用戶創建的對象的默認權限

另一個問題，如何設置用戶新建的對象的默認權限?

在PostgreSQL 9.0以后新加的語法：

ALTER DEFAULT PRIVILEGES

例如

ALTER DEFAULT PRIVILEGES

[ FOR { ROLE | USER } target_role [, ...] ]

[ IN SCHEMA schema_name [, ...] ]

abbreviated_grant_or_revoke

where abbreviated_grant_or_revoke is one of:

GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }

[, ...] | ALL [ PRIVILEGES ] }

ON TABLES

TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]

例子：

將digoal用戶未來在public下面創建的表的select,update權限默認賦予給test用戶.

postgres=> alter default privileges for role digoal in schema public grant select,update on tables to test;

ALTER DEFAULT PRIVILEGES

將test用戶未來在public,digoal下面創建的表的select,update權限默認賦予給digoal用戶.

postgres=# alter default privileges for role test in schema public,digoal grant select,update on tables to digoal;

ALTER DEFAULT PRIVILEGES

查看已經賦予的默認權限

postgres=> \ddp+

Default access privileges

Owner | Schema | Type | Access privileges

----------+--------+-------+---------------------------

digoal | public | table | test=rw/digoal

test | digoal | table | digoal=rw/test

test | public | table | digoal=rw/test

或

SELECT pg_catalog.pg_get_userbyid(d.defaclrole) AS "Owner",

n.nspname AS "Schema",

CASE d.defaclobjtype WHEN 'r' THEN 'table' WHEN 'S' THEN 'sequence' WHEN 'f' THEN 'function' WHEN 'T' THEN 'type' END AS "Type",

pg_catalog.array_to_string(d.defaclacl, E'\n') AS "Access privileges"

FROM pg_catalog.pg_default_acl d

LEFT JOIN pg_catalog.pg_namespace n ON n.oid = d.defaclnamespace

ORDER BY 1, 2, 3;

Owner | Schema | Type | Access privileges

----------+--------+-------+---------------------------

digoal | public | table | test=rw/digoal

postgres | | table | postgres=arwdDxt/postgres+

| | | digoal=arwdDxt/postgres

test | digoal | table | digoal=rw/test

test | public | table | digoal=rw/test

(4 rows)

總結

以上是生活随笔為你收集整理的查看pg　用户组_PostgreSQL 角色用户管理的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。

上一篇： Spring Cloud概念+案例（eu
下一篇：巴身小(leng)一族作为夜郎后裔的历史

数据库

查看pg 用户组_PostgreSQL 角色用户管理

總結

查看pg　用户组_PostgreSQL 角色用户管理