Question

I ran into a very annoying role inheritance issue with PostgreSQL. It simply doesn’t behave as it should according to the documentation.

I would like to have a master role, and grant its permissions to newly created users. These users should inherit the permissions without issuing SET ROLE manually.

CREATE ROLE testrole NOSUPERUSER INHERIT CREATEDB NOCREATEROLE;
CREATE ROLE testuser LOGIN NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE;
GRANT testrole TO testuser;

Now after I connect as testuser, I get the following:

postgres=> CREATE DATABASE foobar;
ERROR:  permission denied to create database
postgres=> SET ROLE testrole;
SET
postgres=> CREATE DATABASE foobar;
CREATE DATABASE

According to the docs linked above (because of the INHERIT option), the SET ROLE shouldn’t be required.

What am I missing here?

Answer 1

A bit further down the same page:

“The role attributes LOGIN, SUPERUSER, CREATEDB, and CREATEROLE can be thought of as special privileges, but they are never inherited as ordinary privileges on database objects are. You must actually SET ROLE to a specific role having one of these attributes in order to make use of the attribute.”