From 8ae0d476a9d5667645c5200d8c6831b2fb7a9a36 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Sun, 14 Aug 2005 20:16:03 +0000 Subject: Update the createuser utility for the ROLEs world. Alvaro Herrera --- doc/src/sgml/ref/createuser.sgml | 184 ++++++++++++++++++++++++++------------- 1 file changed, 124 insertions(+), 60 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/ref/createuser.sgml b/doc/src/sgml/ref/createuser.sgml index a2efe9d7897..3656349f5e3 100644 --- a/doc/src/sgml/ref/createuser.sgml +++ b/doc/src/sgml/ref/createuser.sgml @@ -1,5 +1,5 @@ @@ -32,24 +32,24 @@ PostgreSQL documentation Description createuser creates a - new PostgreSQL user. - Only superusers (users with usesuper set in - the pg_shadow table) can create - new PostgreSQL users, - so createuser must be - invoked by someone who can connect as a PostgreSQL - superuser. + new PostgreSQL user (or more precisely, a role). + Only superusers and users with CREATEROLE privilege can create + new users, so createuser must be + invoked by someone who can connect as a superuser or a user with + CREATEROLE privilege. - Being a superuser also implies the ability to bypass access permission + If you wish to create a new superuser, you must connect as a + superuser, not merely with CREATEROLE privilege. + Being a superuser implies the ability to bypass all access permission checks within the database, so superuserdom should not be granted lightly. createuser is a wrapper around the - SQL command . + SQL command . There is no effective difference between creating users via this utility and via other methods for accessing the server. @@ -70,32 +70,28 @@ PostgreSQL documentation Specifies the name of the PostgreSQL user to be created. - This name must be unique among all users of this + This name must be different from all existing roles in this PostgreSQL installation. - - + + - The new user is allowed to create other users. - (Note: Actually, this makes the new user a superuser. - The option is poorly named.) + The new user will be a superuser. - - + + - The new user is not allowed to create other users (i.e., - the new user is a regular user, not a superuser). - This is the default. + The new user will not be a superuser. @@ -105,7 +101,7 @@ PostgreSQL documentation - The new user is allowed to create databases. + The new user will be allowed to create databases. @@ -115,52 +111,86 @@ PostgreSQL documentation - The new user is not allowed to create databases. - This is the default. + The new user will not be allowed to create databases. - - + + - Echo the commands that createuser generates - and sends to the server. + The new user will be allowed to create new roles (that is, + this user will have CREATEROLE privilege). - - + + - Encrypts the user's password stored in the database. If not - specified, the default password behavior is used. + The new user will not be allowed to create new roles. - - + + - Allows you to pick a non-default user ID for the new user. This is not - necessary, but some people like it. + The new user will be allowed to log in (that is, the user name + can be used as the initial session user identifier). + This is the default. - - + + - Does not encrypt the user's password stored in the database. If - not specified, the default password behavior is used. + The new user will not be allowed to log in. + (A role without login privilege is still useful as a means of + managing database permissions.) + + + + + + + + + + The new role will automatically inherit privileges of roles + it is a member of. + This is the default. + + + + + + + + + + The new role will not automatically inherit privileges of roles + it is a member of. + + + + + + + + + + Set a maximum number of connections for the new user. + The default is to set no limit. @@ -177,6 +207,39 @@ PostgreSQL documentation + + + + + + Encrypts the user's password stored in the database. If not + specified, the default password behavior is used. + + + + + + + + + + Does not encrypt the user's password stored in the database. If + not specified, the default password behavior is used. + + + + + + + + + + Echo the commands that createuser generates + and sends to the server. + + + + @@ -204,10 +267,10 @@ PostgreSQL documentation - Specifies the host name of the machine on which the - server - is running. If the value begins with a slash, it is used - as the directory for the Unix domain socket. + Specifies the host name of the machine on which the + server + is running. If the value begins with a slash, it is used + as the directory for the Unix domain socket. @@ -217,9 +280,9 @@ PostgreSQL documentation - Specifies the TCP port or local Unix domain socket file - extension on which the server - is listening for connections. + Specifies the TCP port or local Unix domain socket file + extension on which the server + is listening for connections. @@ -272,8 +335,8 @@ PostgreSQL documentation Diagnostics - In case of difficulty, see and for + In case of difficulty, see and for discussions of potential problems and error messages. The database server must be running at the targeted host. Also, any default connection settings and environment @@ -292,8 +355,9 @@ PostgreSQL documentation server: $ createuser joe -Shall the new user be allowed to create databases? (y/n) n -Shall the new user be allowed to create more new users? (y/n) n +Shall the new role be a superuser? (y/n) n +Shall the new role be allowed to create databases? (y/n) n +Shall the new role be allowed to create more new roles? (y/n) n CREATE USER @@ -303,9 +367,9 @@ PostgreSQL documentation server on host eden, port 5000, avoiding the prompts and taking a look at the underlying command: -$ createuser -h eden -p 5000 -D -A -e joe -CREATE USER joe NOCREATEDB NOCREATEUSER; -CREATE USER +$ createuser -h eden -p 5000 -S -D -R -e joe +CREATE ROLE joe NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT LOGIN; +CREATE ROLE @@ -313,11 +377,11 @@ PostgreSQL documentation To create the user joe as a superuser, and assign a password immediately: -$ createuser -P -d -a -e joe -Enter password for new user: xyzzy +$ createuser -P -s -e joe +Enter password for new role: xyzzy Enter it again: xyzzy -CREATE USER joe PASSWORD 'xyzzy' CREATEDB CREATEUSER; -CREATE USER +CREATE ROLE joe PASSWORD 'xyzzy' SUPERUSER CREATEDB CREATEROLE INHERIT LOGIN; +CREATE ROLE In the above example, the new password isn't actually echoed when typed, but we show what was typed for clarity. However the password @@ -333,7 +397,7 @@ PostgreSQL documentation - + Environment Variables () -- cgit v1.2.3