How to alter default permissions by schema?

[ddp111]

I would like to be able to assign LDAP users read permissions to future tables in a given schema. I have tried to do this in a couple different ways that have not worked. Here are simplified examples of my ldap2pg.yml

version: 6
    
postgres:
  roles_blacklist_query:
    - postgres
    - ...
privileges:
  default_ro:
  - __connect__           
  - __usage_on_schemas__  
  - __select_on_tables__  
  - __select_on_sequences__
  - __usage_on_sequences__ 
rules:
- roles:
  - name: readers
  grant:
    - privilege: default_ro
      role: readers
      database: db1
      schemas: [schema1, schema2]
- description: "Synchronize LDAP Users"
  ldapsearch:
    base: "OU=xxx,OU=yyy,DC=zzz,DC=aaa"
    filter: "(&(objectClass=person)(memberOf=CN=nnnn,OU=mmm,OU=aaaa,DC=bbbb,DC=cccc))"
  roles:
  - name: "{sAMAccountName}"
    comment: "LDAP user {sAMAccountName}"
    options: LOGIN
    parent: readers

version: 6
    
postgres:
  roles_blacklist_query:
    - postgres
    - ...
privileges:
  default_ro:
  - __connect__           
  - __usage_on_schemas__  
  - __select_on_tables__  
  - on: SCHEMA DEFAULT
    type: SELECT
    object: TABLES
rules:
- roles:
  - name: readers
  grant:
    - privilege: default_ro
      role: readers
      database: db1
      schemas: [schema1, schema2]
- description: "Synchronize LDAP Users"
  ldapsearch:
    base: "OU=xxx,OU=yyy,DC=zzz,DC=aaa"
    filter: "(&(objectClass=person)(memberOf=CN=nnnn,OU=mmm,OU=aaaa,DC=bbbb,DC=cccc))"
  roles:
  - name: "{sAMAccountName}"
    comment: "LDAP user {sAMAccountName}"
    options: LOGIN
    parent: readers

version: 6
    
postgres:
  roles_blacklist_query:
    - postgres
    - ...
privileges:
  default_ro:
  - __connect__           
  - __usage_on_schemas__  
  - __select_on_tables__  
  - __default_select_on_tables__
rules:
- roles:
  - name: readers
  grant:
    - privilege: default_ro
      role: readers
      database: db1
      schemas: [schema1, schema2]
- description: "Synchronize LDAP Users"
  ldapsearch:
    base: "OU=xxx,OU=yyy,DC=zzz,DC=aaa"
    filter: "(&(objectClass=person)(memberOf=CN=nnnn,OU=mmm,OU=aaaa,DC=bbbb,DC=cccc))"
  roles:
  - name: "{sAMAccountName}"
    comment: "LDAP user {sAMAccountName}"
    options: LOGIN
    parent: readers

None of these configurations have worked when a new table has been added and attempted to be read by a given user. In my DDLs I would write something like

ALTER DEFAULT PRIVILEGES IN SCHEMA schema1 GRANT SELECT ON TABLES TO user;

What is the equivolent to this using LDAP2PG?

[bersace]

Hi @ddp111 . Yes, ldap2pg configures default privileges for managed users having CREATE on schemas.

https://ldap2pg.readthedocs.io/en/latest/privileges/#managing-public-privileges

Do you manage owners with ldap2pg ?

[ddp111]

We have not previously but it seems that the blacklist didn't work as we expected so we may need to start managing them with ldap2pg now. Could you provide more templates/examples?