pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedPermission for not Django app to do Write and Read
4+ messages / 3 participants
[nested] [flat]
* Permission for not Django app to do Write and Read
@ 2019-08-21 18:17 Peter Wainaina <petwah17@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Peter Wainaina @ 2019-08-21 18:17 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
I am managing some development and I need to give Write and Read to only
Django .Postgresql administratior can’t write on the same data.How can I
configure that from postgresql side.
--
*WEB developer and programmer*
*system analyst-crm*
*blogger*
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Permission for not Django app to do Write and Read
@ 2019-08-24 09:45 Luca Ferrari <fluca1978@gmail.com>
parent: Peter Wainaina <petwah17@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Luca Ferrari @ 2019-08-24 09:45 UTC (permalink / raw)
To: Peter Wainaina <petwah17@gmail.com>; +Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
On Wed, Aug 21, 2019 at 8:26 PM Peter Wainaina <petwah17@gmail.com> wrote:
>
> I am managing some development and I need to give Write and Read to only Django .Postgresql administratior can’t write on the same data.How can I configure that from postgresql side.
You should better explain what you are trying to achieve.
I suspect what you need is to create an user to use frm your django
application, then GRANT to such user the ALL permission on the
objects/tables you need.
Or assign such user as the owner of all the objects.
Luca
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Permission for not Django app to do Write and Read
@ 2019-08-24 11:22 Luca Ferrari <fluca1978@gmail.com>
parent: Luca Ferrari <fluca1978@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Luca Ferrari @ 2019-08-24 11:22 UTC (permalink / raw)
To: Peter Wainaina <petwah17@gmail.com>; +Cc: pgsql-general <pgsql-general@postgresql.org>
On Sat, Aug 24, 2019 at 11:53 AM Peter Wainaina <petwah17@gmail.com> wrote:
>
> Thanks much for the response. This is what I mean am a database administrator for a production company and the product owner doesn't want me to be able to either read or write information that will come from Django application.
I personally hate this kind of setup, because it does not make any
sense to me that a developer must setup an application that must
interact with a database that the developer himself cannot interact
with.
However, keep it simple: define a django user, assign each object to
such user, revoke any permission from public.
And then let's the product owner setup a password.
Or look at pgcrypto, because the ony reliable way to deal with "don't
look at my data" setup is cryptography.
Luca
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Permission for not Django app to do Write and Read
@ 2019-08-25 08:44 Peter J. Holzer <hjp-pgsql@hjp.at>
parent: Luca Ferrari <fluca1978@gmail.com>
0 siblings, 0 replies; 4+ messages in thread
From: Peter J. Holzer @ 2019-08-25 08:44 UTC (permalink / raw)
To: pgsql-general@lists.postgresql.org
On 2019-08-24 13:22:38 +0200, Luca Ferrari wrote:
> On Sat, Aug 24, 2019 at 11:53 AM Peter Wainaina <petwah17@gmail.com> wrote:
> >
> > Thanks much for the response. This is what I mean am a database
^^^^^^^^^^^^^
> > administrator for a production company and the product owner doesn't
^^^^^^^^^^^^^
> > want me to be able to either read or write information that will
> > come from Django application.
>
> I personally hate this kind of setup, because it does not make any
> sense to me that a developer must setup an application that must
> interact with a database that the developer himself cannot interact
> with.
Peter is the DBA here, not the developer. I don't think you can prevent
the DBA from seeing the data in the database - except by encrypting it
(as you suggested below). I guess it would be possible to write a Django
backend which implements an encryption layer, but getting decent
performance out of it might be ... challenging.
> However, keep it simple: define a django user, assign each object to
> such user, revoke any permission from public.
> And then let's the product owner setup a password.
You can still access the tables as postgres.
Of course you could set up another database instance where you don't
have DBA privileges, but then the product owner has to trust the system
administrator instead of the DBA. At some point you have to trust
somebody or do everything yourself.
hp
--
_ | Peter J. Holzer | we build much bigger, better disasters now
|_|_) | | because we have much more sophisticated
| | | hjp@hjp.at | management tools.
__/ | http://www.hjp.at/ | -- Ross Anderson <https://www.edge.org/;
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2019-08-25 08:44 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2019-08-21 18:17 Permission for not Django app to do Write and Read Peter Wainaina <petwah17@gmail.com>
2019-08-24 09:45 ` Luca Ferrari <fluca1978@gmail.com>
2019-08-24 11:22 ` Luca Ferrari <fluca1978@gmail.com>
2019-08-25 08:44 ` Peter J. Holzer <hjp-pgsql@hjp.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox