USERADMIN

The USERADMIN role is a predefined role that lets you delegate user, role, and privilege administration without granting broader database administration capabilities.

The USERADMIN role is a predefined role that lets you delegate user, role, and privilege administration without requiring the broader capabilities of the DBADMIN or PSEUDOSUPERUSER roles. Use USERADMIN to support least-privilege and separation-of-duties requirements when you need a dedicated administrative role for identity and access management that is independent of any broader database administration responsibilities.

The dbadmin user and users with the PSEUDOSUPERUSER role can grant USERADMIN to any user or non-predefined role.

USERADMIN privileges

Users with the USERADMIN role can perform any of the following operations on users and roles:

  • Create, alter, and drop users

  • Create, alter, and drop roles

  • Grant and revoke roles

  • Grant and revoke privileges

USERADMIN limitations

USERADMIN cannot grant any of the following predefined roles, which carry broader administrative privileges, to other users or roles:

  • DBADMIN

  • PSEUDOSUPERUSER

  • SYSMONITOR

  • UDXDEVELOPER

  • MLSUPERVISOR

Unlike PSEUDOSUPERUSER, USERADMIN does not bypass GRANT/REVOKE authorization. To grant or revoke a privilege, a USERADMIN user must hold that privilege themselves (with the GRANT OPTION), the same as any other user or role.

Example

The following example grants the USERADMIN role directly to user alice:

=> GRANT USERADMIN TO alice;
GRANT ROLE

After alice enables the USERADMIN role, she can create and manage users and roles without requiring DBADMIN or PSEUDOSUPERUSER privileges:

=> \c - alice
You are now connected as user "alice".
=> SET ROLE useradmin;
SET
=> CREATE USER bob;
CREATE USER
=> CREATE ROLE analyst;
CREATE ROLE
=> GRANT analyst TO bob;
GRANT ROLE