role.diff

text/x-diff

Download

Patch

Format: unified

File	+	−
doc/src/sgml/ref/create_role.sgml	24	14

diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgml
index 8dd2a6395c..5c2b71bf69 100644
--- a/doc/src/sgml/ref/create_role.sgml
+++ b/doc/src/sgml/ref/create_role.sgml
@@ -133,16 +133,24 @@ in sync when changing the above synopsis!
       <term><literal>NOINHERIT</literal></term>
       <listitem>
        <para>
-        When the <literal>GRANT</literal> statement is used to confer
-        membership in one role to another role, the <literal>GRANT</literal>
-        may use the <literal>WITH INHERIT</literal> clause to specify whether
-        the privileges of the granted role should be <quote>inherited</quote>
-        by the new member. If the <literal>GRANT</literal> statement does not
-        specify either inheritance behavior, the new <literal>GRANT</literal>
-        will be created <literal>WITH INHERIT TRUE</literal> if the member
-        role is set to <literal>INHERIT</literal> and to
-        <literal>WITH INHERIT FALSE</literal> if it is set to
-        <literal>NOINHERIT</literal>.
+        This controls the membership inheritance status when a new role
+        is added as a member using the <literal>IN ROLE</literal> clause,
+        when this role is later added as a member of a new role with the
+        <literal>ROLE</literal> clause, and the default inheritance when
+        adding this role as a member using the <literal>GRANT</literal>
+        statement.  In such <literal>GRANT</literal> statements, the
+        role's inheritance status will be used unless overridden by the
+        <literal>GRANT</literal> <literal>WITH INHERIT</literal> clause.
+       </para>
+
+       <para>
+        Role membership with the inherit attribute can automatically
+        use whatever database privileges have been granted to all
+        roles it is directly or indirectly a member of, though the
+        chain stops at memberships without the inherit attribute.
+        Without role inheritance, the only other value of membership
+        is via <command>SET ROLE</command>, assuming the membership has
+        the <literal>SET</literal> attribute.
        </para>
 
        <para>
@@ -286,8 +294,8 @@ in sync when changing the above synopsis!
         The <literal>IN ROLE</literal> clause causes the new role to
         be automatically added as a member of the specified existing
         roles. (Note that there is no option to add the new role as an
-        administrator; use a separate <command>GRANT</command> command
-        to do that.)
+        administrator or to disallow <literal>SET ROLE</literal>; use a
+        separate <command>GRANT</command> command to do that.)
        </para>
       </listitem>
      </varlistentry>
@@ -460,8 +468,10 @@ CREATE ROLE <replaceable class="parameter">name</replaceable> [ WITH ADMIN <repl
 
   <para>
    The behavior specified by the SQL standard is most closely approximated
-   by giving users the <literal>NOINHERIT</literal> attribute, while roles are
-   given the <literal>INHERIT</literal> attribute.
+   by giving <literal>LOGIN</literal> roles
+   the <literal>NOINHERIT</literal> attribute, while
+   <literal>NOLOGIN</literal>roles are given the <literal>INHERIT</literal>
+   attribute.
   </para>
 
   <para>