13

I recently wanted to share regular access rights with one user of a server and I realized that a simple CREATE USER and GRANT ALL ON DATABASE commands didn't let him run a simple SELECT on the data.

I would like to grant rights to all tables from a given database to a specified user, but I am not sure if it is the best idea to grant him access to whole schema public as I don't know if it would allow some kind of privilege escalation. Is there any other way?

  • Why can't you just GRANT SELECT ON TableName TO [Domain\User]? I usually just assign users to the db_datareader role if all they need is read access to all the tables but I'm not sure how granular you want to be. – Kris Gruttemeyer Feb 14 '15 at 12:41
  • I'd like to grant all CRUD to all tables in the database. Also, DROPping and CREATEing inside of this database could also prove useful. – d33tah Feb 14 '15 at 12:43
19

The privilege on DATABASE only grants general connection rights to the database and no more. A user with just that privilege can only see what the general public is allowed to see.

To grant read access to all tables, you also need privileges on all schemas and tables:

GRANT USAGE ON SCHEMA public TO myuser; -- more schemas?
GRANT SELECT ON ALL TABLES IN SCHEMA public TO myuser;

You may also want to set default privileges for future schemas and tables. Run for every role that creates objects in your db

ALTER DEFAULT PRIVILEGES FOR ROLE mycreating_user IN SCHEMA public
GRANT SELECT ON TABLES TO myuser;

But you really need to understand the whole concept first.
And it's almost always better to bundle privileges in group roles and then grant/revoke the group role to/from user roles. Related:

  • Is myusr a typo? Shouldn't it be myuser? – attomos Feb 14 '18 at 3:36
  • 1
    @attomos: It's supposed to be a different user in the example. I clarified. – Erwin Brandstetter Feb 14 '18 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.