Sql 使用级联权限为Postgre数据库创建角色树

Sql 使用级联权限为Postgre数据库创建角色树,sql,postgresql,roles,postgresql-9.5,Sql,Postgresql,Roles,Postgresql 9.5,如何为可以执行以下操作的用户创建postgresql数据库的正确角色树: 只读选择数据A A+修改插入、删除、更新数据B B+创建表C C+创建表和所有特权D 我查阅了关于和的文档,但没有任何东西可以帮助我理解Postgres如何处理角色。创建示例角色的实际脚本: 好的,角色和用户已创建,现在在以下行中使用错误进行测试: -- connect as "ud" create table ud_a (a numeric); -- OK insert into ud_a values (1); --

如何为可以执行以下操作的用户创建postgresql数据库的正确角色树:

只读选择数据A A+修改插入、删除、更新数据B B+创建表C C+创建表和所有特权D 我查阅了关于和的文档,但没有任何东西可以帮助我理解Postgres如何处理角色。创建示例角色的实际脚本:

好的,角色和用户已创建,现在在以下行中使用错误进行测试:

-- connect as "ud"
create table ud_a (a numeric); -- OK
insert into ud_a values (1); -- OK
select * from ud_a; -- OK -- 1 row

-- connect as "uc"
select * from ud_a; -- SQL Error [42501]: ERROR: permission denied for relation ud_a

-- As user "uc" I cannot insert value, or drop table
insert into ud_a values (2); -- **SQL Error [42501]: ERROR: permission denied for relation ud_a**
drop table ud_a; -- **SQL Error [42501]: ERROR: must be owner of relation ud_a**

-- But I can create new table! As "uc":
create table uc_a (a numeric); -- OK
insert into uc_a values (2); -- OK

-- After this when i connect as more powerfull user - "ud"
-- I cannot even read from this table even though my user "ud" is created under role "rd" with "grant 'rc' to 'rd'":
select * from uc_a; -- SQL Error [42501]: ERROR: permission denied for relation uc_a

-- Connect as "ua" for read only return also errors for selects:
select * from ud_a; -- SQL Error [42501]: ERROR: permission denied for relation ud_a
select * from uc_a; -- SQL Error [42501]: ERROR: permission denied for relation uc_a
清洁:

-- as "postgres":
drop owned by "ud"; drop owned by "uc"; drop owned by "ub"; drop owned by "ua";
drop role "ud"; drop role "uc"; drop role "ub"; drop role "ua";
drop owned by "rd"; drop owned by "rc"; drop owned by "rb"; drop owned by "ra";
drop role "rd"; drop role "rc"; drop role "rb"; drop role "ra";
drop database daba;
我需要创建角色结构,其中用户A可以选择由用户C或D创建的所有表,并且所有用户都从优先级继承,因此可以选择用户A的所有内容都可以选择用户B、C和D,并且角色D可以将用户创建的表放在角色C下,以此类推

你能帮我吗

-- as "postgres":
drop owned by "ud"; drop owned by "uc"; drop owned by "ub"; drop owned by "ua";
drop role "ud"; drop role "uc"; drop role "ub"; drop role "ua";
drop owned by "rd"; drop owned by "rc"; drop owned by "rb"; drop owned by "ra";
drop role "rd"; drop role "rc"; drop role "rb"; drop role "ra";
drop database daba;