Doubts about Running Unprivileged

[rodyn379]

I'm having trouble understanding the correct setup for running ldap2pg with an unprivileged user and would appreciate some clarification.

According to the documentation:

ldap2pg is designed to run unprivileged. Synchronization user needs CREATEROLE option to manage other unprivileged roles. CREATEDB options allows synchronization user to managed database owners.

Based on this, I expected that creating a synchronization user with the following commands would be sufficient:

CREATE ROLE ldap2pg LOGIN CREATEDB CREATEROLE;
ALTER ROLE ldap2pg SET createrole_self_grant TO 'inherit,set';

When I run ldap2pg using this user, I get the error:

databases: default database not listed

The only way I can get it to work is by making the user the owner of the database I want to sync.

My questions are:

1. Is there something I'm missing in my user setup?
2. Does the synchronization user need additional permissions beyond CREATEDB and CREATEROLE?
3. Is making the user a database owner the intended approach, or should the setup I tried work?

Any guidance would be greatly appreciated!

Environment details:

• PostgreSQL version: 16.6
• ldap2pg version: 6.4.2

[bersace]

Hi,

• you must connect to one of the managed databases
• ldap2pg 6.5 will accept to connect to database with CONNECT only privileges

Attempt to manage database ownership will fails with a postgresql error.

ldap2pg reassigns objects of dropped users to database owner.
If you cant assign object to the database owner, you'll be in trouble.

The base rule is that ldap2pg must have the privileges it manages.