@@ -241,9 +241,12 @@ CREATE USER <replaceable>name</replaceable>;
241
241
<term>inheritance of privileges<indexterm><primary>role</primary><secondary>privilege to inherit</secondary></indexterm></term>
242
242
<listitem>
243
243
<para>
244
- A role is given permission to inherit the privileges of roles it is a
245
- member of, by default. However, to create a role without the permission,
246
- use <literal>CREATE ROLE <replaceable>name</replaceable> NOINHERIT</literal>.
244
+ A role inherits the privileges of roles it is a member of, by default.
245
+ However, to create a role which does not inherit privileges by
246
+ default, use <literal>CREATE ROLE <replaceable>name</replaceable>
247
+ NOINHERIT</literal>. Alternatively, inheritance can be overriden
248
+ for individual grants by using <literal>WITH INHERIT TRUE</literal>
249
+ or <literal>WITH INHERIT FALSE</literal>.
247
250
</para>
248
251
</listitem>
249
252
</varlistentry>
@@ -357,25 +360,26 @@ REVOKE <replaceable>group_role</replaceable> FROM <replaceable>role1</replaceabl
357
360
database session has access to the privileges of the group role rather
358
361
than the original login role, and any database objects created are
359
362
considered owned by the group role not the login role. Second, member
360
- roles that have the <literal>INHERIT</literal> attribute automatically have use
361
- of the privileges of roles of which they are members, including any
363
+ roles that have the been granted membership with the
364
+ <literal>INHERIT</literal> option automatically have use
365
+ of the privileges of those roles, including any
362
366
privileges inherited by those roles.
363
367
As an example, suppose we have done:
364
368
<programlisting>
365
- CREATE ROLE joe LOGIN INHERIT ;
366
- CREATE ROLE admin NOINHERIT ;
367
- CREATE ROLE wheel NOINHERIT ;
368
- GRANT admin TO joe;
369
- GRANT wheel TO admin;
369
+ CREATE ROLE joe LOGIN;
370
+ CREATE ROLE admin;
371
+ CREATE ROLE wheel;
372
+ GRANT admin TO joe WITH INHERIT TRUE ;
373
+ GRANT wheel TO admin WITH INHERIT FALSE ;
370
374
</programlisting>
371
375
Immediately after connecting as role <literal>joe</literal>, a database
372
376
session will have use of privileges granted directly to <literal>joe</literal>
373
377
plus any privileges granted to <literal>admin</literal>, because <literal>joe</literal>
374
378
<quote>inherits</quote> <literal>admin</literal>'s privileges. However, privileges
375
379
granted to <literal>wheel</literal> are not available, because even though
376
380
<literal>joe</literal> is indirectly a member of <literal>wheel</literal>, the
377
- membership is via <literal>admin</literal> which has the <literal>NOINHERIT</literal>
378
- attribute. After:
381
+ membership is via <literal>admin</literal> which was granted using
382
+ <literal>WITH INHERIT FALSE</literal>. After:
379
383
<programlisting>
380
384
SET ROLE admin;
381
385
</programlisting>
0 commit comments