Merge pull request #395 from thunderkeys/postgresql-server-role-inherit-support

Postgresql server role inherit support

README.md

@@ -689,6 +689,9 @@ Whether to grant the ability to create new roles with this role. Defaults to `fa
 ####`login`
 Whether to grant login capability for the new role. Defaults to `false`.
 
+####`inherit`
+Whether to grant inherit capability for the new role. Defaults to `true`.
+
 ####`superuser`
 Whether to grant super user capability for the new role. Defaults to `false`.
 

manifests/server/role.pp

@@ -5,6 +5,7 @@ define postgresql::server::role(
   $createrole       = false,
   $db               = $postgresql::server::default_database,
   $login            = true,
+  $inherit          = true,
   $superuser        = false,
   $replication      = false,
   $connection_limit = '-1',
@@ -16,6 +17,7 @@ define postgresql::server::role(
   $version    = $postgresql::server::version
 
   $login_sql       = $login       ? { true => 'LOGIN',       default => 'NOLOGIN' }
+  $inherit_sql     = $inherit     ? { true => 'INHERIT',     default => 'NOINHERIT' }
   $createrole_sql  = $createrole  ? { true => 'CREATEROLE',  default => 'NOCREATEROLE' }
   $createdb_sql    = $createdb    ? { true => 'CREATEDB',    default => 'NOCREATEDB' }
   $superuser_sql   = $superuser   ? { true => 'SUPERUSER',   default => 'NOSUPERUSER' }
@@ -55,6 +57,10 @@ define postgresql::server::role(
     unless => "SELECT rolname FROM pg_roles WHERE rolname='${username}' and rolcanlogin=${login}",
   }
 
+  postgresql_psql {"ALTER ROLE \"${username}\" ${inherit_sql}":
+    unless => "SELECT rolname FROM pg_roles WHERE rolname='${username}' and rolinherit=${inherit}",
+  }
+
   if(versioncmp($version, '9.1') >= 0) {
     if $replication_sql == '' {
       postgresql_psql {"ALTER ROLE \"${username}\" NOREPLICATION":

spec/acceptance/server/role_spec.rb

@@ -85,4 +85,32 @@ describe 'postgresql::server::role:', :unless => UNSUPPORTED_PLATFORMS.include?(
       expect(r.stderr).to eq('')
     end
   end
+
+  it 'should idempotently create a user with noinherit' do
+    pp = <<-EOS.unindent
+      $user = "postgresql_test_noinherit"
+      $password = "postgresql_test_noinherit"
+
+      class { 'postgresql::server': }
+
+      # Since we are not testing pg_hba or any of that, make a local user for ident auth
+      user { $user:
+        ensure => present,
+      }
+
+      postgresql::server::role { $user:
+        password_hash => $password,
+        inherit       => false,
+      }
+    EOS
+
+    apply_manifest(pp, :catch_failures => true)
+    apply_manifest(pp, :catch_changes => true)
+
+    # Check that the user has noinherit set
+    psql('--command="select rolname from pg_roles where not rolinherit" postgres', 'postgresql_test_noinherit') do |r|
+      expect(r.stdout).to match(/postgresql_test_noinherit/)
+      expect(r.stderr).to eq('')
+    end
+  end
 end