PostgreSQL角色（二）

role角色

1.define定義

       在PostgreSQL中能夠由超級用戶或者擁有createrole權限的角色使用用create role命令定義一個數據庫層次（全部數據庫都可用）的新角色。具體語法就不另做說明了，在此僅就語法中幾個參數加以說明：

•INHERIT：默認定義，使用這個參數定義的角色自動擁有其所屬角色組擁有的數據庫權限
•IN ROLE：將新角色定義爲所列出角色的成員
•ROLE：定義新角色爲角色組，而所列角色成爲該角色組的成員
•ADMIN：做用與role相同，區別在於所列角色擁有新角色的with admin option權限，便可以將新角色的權限賦予給其餘用戶
//實驗三，驗證上述四個參數

lihao=# create role role1 nosuperuser nocreatedb nocreaterole noreplication noinherit password 'oracle';

CREATE ROLE

lihao=# create user user1 in role role1 password 'oracle';

CREATE ROLE

lihao=# create role role2 nosuperuser nocreatedb nocreaterole noreplication noinherit login password 'oracle';
CREATE ROLE

lihao=# create role role3 role role2 login;
CREATE ROLE
lihao=# create role role4 nosuperuser nocreatedb nocreaterole noreplication noinherit loginpassword 'oracle';
CREATE ROLE
lihao=# create role role5 admin role4 login;
CREATE ROLE
lihao=# \du+
                                    List of roles
 Role name |                   Attributes                                           | Member of | Description
---------+--------------------------------------------------------+-------------+---------
 lihao     | Superuser, Create role, Create DB, Replication         | {}                  |
 role1     | No inheritance                                                          | {}                   |
 role2     | No inheritance                                                          | {role3}           |
 role3     |                                                                                   | {}                   |
 role4     | No inheritance                                                          | {role5}           |
 role5     |                                                                                   | {}                   |
 user1     |                                                                                   | {role1}          |
lihao=# \c lihao role4
You are now connected to database "lihao" as user "role4".
lihao=# grant role5 to user1;
GRANT ROLE
lihao=# \c lihao role2
You are now connected to database "lihao" as user "role2".
lihao=# grant role3 to user1;
ERROR:  must have admin option on role "role3"
lihao=# \du+
                                            List of roles
 Role name |                   Attributes                                           | Member of | Description
---------+--------------------------------------------------------+-------------+---------
 lihao     | Superuser, Create role, Create DB, Replication         | {}                  |
 role1     | No inheritance                                                          | {}                   |
 role2     | No inheritance                                                          | {role3}           |
 role3     |                                                                                   | {}                   |
 role4     | No inheritance                                                          | {role5}           |
 role5     |                                                                                   | {}                   |
 user1     |                                                                                   | {role1,role5} | 

2.set role

    將當前會話的當前角色更改成所指定角色，修改爲功後，當前會話的命令權限使用的是新角色權限。須要注意的是：指定角色必須是超級用戶或者是當前會話角色所在的角色組。

lihao=# create role role1 login password 'oracle';
CREATE ROLE
lihao=# create user user1 in role role1 noinherit password 'oracle';
CREATE ROLE
lihao=# grant select on table t1 to role1;
GRANT
lihao=# grant select on table t2 to user1;
GRANT
lihao=# \du+
                                    List of roles
 Role name |                   Attributes                                          | Member of | Description
-------------+---------------------------------------------------+-------------+-------------
 lihao           | Superuser, Create role, Create DB, Replication | {}                  |
 role1           |                                                                            | {}                  |
 user1           | No inheritance                                                  | {role1}           |
lihao=# \dp
                                       Access privileges
 schema |       Name        |   Type   |  Access privileges  | Column access privileges

---------+----------------+--------+----------------------+--------------------------

 public  | t1                      | table     | lihao=arwdDxt/lihao+|
             |                          |              | role1=r/lihao       |
 public  | t2                      | table     | lihao=arwdDxt/lihao+|
             |                          |              | user1=r/lihao       |
[lihao@lihao ~]$ psql -U user1 -d lihao
psql (9.1.8)
Type "help" for help.

lihao=> select * from t1;
ERROR:  permission denied for relation t1
lihao=> set role role1;
SET
lihao=> select * from t1;
 id
----
(0 rows)
lihao=> select * from t2;
ERROR:  permission denied for relation t2

[lihao@lihao ~]$ psql -U role1 -d lihao
psql (9.1.8)
Type "help" for help.

lihao=> set role user1;
ERROR:  permission denied to set role "user1"

3.set session authorization

這條命令相似於SET ROLE，區別在於：SET ROLE是由組成員角色變成組角色，而SET SESSION AUTHORIZATION倒是反過來的；並且SET ROLE只能更改current_user，然後者能夠更改current_user和session_user。通常來講，session_user = current_user，在類Unix系統中，session_user是「真正的用戶」，而current_user是「起做用的用戶」。

[lihao@lihao ~]$ psql -U role1 -d lihao
psql (9.1.8)
Type "help" for help.

lihao=# select session_user,current_user;
 session_user | current_user
--------------+--------------
 role1            | role1
(1 row)
lihao=# set session authorization user1;
SET
lihao=> select session_user,current_user;
 session_user | current_user
--------------+--------------
 user1           | user1
(1 row)
lihao=> select * from t2;
 id
----
(0 rows)
lihao=> set role role1;
SET
lihao=# select session_user,current_user;
 session_user | current_user
--------------+--------------
 user1           | role1(1 row)
lihao=# select * from t1;
 id
----
(0 rows)
lihao=# select * from t2;
 id
----
(0 rows)

[lihao@lihao ~]$ psql -U user1 -d lihao
psql (9.1.8)
Type "help" for help.

lihao=> set session authorization role1;
ERROR:  permission denied to set session authorization

4.結論

SET ROLE命令成功後，還能夠繼續使用原用戶權限（即set role role1後可select * from t2;)，而SET SESSION AUTHORIZATION 就不能，能夠得出結論：session_user和current_user不一樣時，可使用兩者的權限；相同時，只能調用current_user的權限。

我的認爲這兩條命令很危險，理由以下：

• 在命令行下執行這兩條命令不須要進行密碼驗證

• 命令執行成功後，可調用alter user命令更改當前用戶的屬性，好比密碼

• 當兩個用戶中有一個擁有一些系統權限，如superuser或createrole等權限時，徹底可用這兩條命令進行切換，而後進行一些危險操做