Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ldap2pg using a non-superuser role is logging "ERROR: permission denied to reassign objects"

Open
  • Is something wrong?
#799 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
54/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
go, postgresql
Domain
backend, databases

Research direction

Start by reading the database cleanup path that runs REASSIGN OWNED and DROP OWNED when a managed role is removed, along with the configuration handling for databases_query. The report establishes the failing non-superuser case and asks for a way to skip cleanup when managed roles own no database objects; done means that case can be configured without weakening the database connection requirement.

Written by the indexing model from the issue text.

Description

Remove managed roles using a non-superuser

I'm running ldap2pg with a non-superuser called ldap2pg. Now, when ldap2pg removes a managed role, it logs:

LOG:  statement: REASSIGN OWNED BY "myrole" TO "postgres";
	DROP OWNED BY "myrole";
ERROR:  permission denied to reassign objects
DETAIL:  Only roles with privileges of role "myrole" may reassign objects owned by it.

I tried making the DB User ldap2pg a member of myrole (GRANT myrole TO ldap2pg), but then ldap2pg logs:

LOG:  statement: REASSIGN OWNED BY "myrole" TO "postgres";
	DROP OWNED BY "myrole";
ERROR:  permission denied to reassign objects
DETAIL:  Only roles with privileges of role "postgres" may reassign objects to it.

So I would also need to GRANT postgres TO ldap2pg, but then using a non-superuser isn't meaningful anymore.

I realized that I encountered this issue already 4 years ago: #421. My solution back then was to set databases_query: [none], because I'm not using ldap2pg for managing privileges, and because none of my LDAP users is ever owning any DB object.

However, now that I'm finally upgrading to v6.6.0, this isn't possible anymore. If I set databases_query: [none],
ldap2pg exits with:

level=ERROR msg="databases: connected to an unmanaged database"

(And the docs clearly state that the databases_query must return at least the database that ldap2pg is connected to.)

Is there any other way to skip the REASSIGN OWNED and DROP OWNED step?

Dominant language
Go
Stars
241
Forks
37
Avg merge
1d 11h
Merged PRs (30d)
2

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dalibo/ldap2pg

All issues in dalibo/ldap2pg

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.