From: Kevin Grittner <Kevin.Grittner@wicourts.gov>
To: Rafael Domiciano <rafael.domiciano@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-admin@postgresql.org
Cc: Milen A. Radev <milen@radev.net>
Subject: Re: Revoke for a new role
Date: Thu, 19 Jun 2008 12:56:51 -0500
Message-ID: <485A5758.EE98.0025.0@wicourts.gov> (raw)
In-Reply-To: <3a0028490806130906i553f9588g810b2d19d95a91a1@mail.gmail.com>
References: <3a0028490806130635v2a0890easf8c22b8362d06e89@mail.gmail.com>
<g2tur0$rtq$1@ger.gmane.org>
<11208.1213369902@sss.pgh.pa.us>
<3a0028490806130906i553f9588g810b2d19d95a91a1@mail.gmail.com>
>>> On Fri, Jun 13, 2008 at 11:06 AM, in message
<3a0028490806130906i553f9588g810b2d19d95a91a1@mail.gmail.com>, "Rafael
Domiciano" <rafael.domiciano@gmail.com> wrote:
> So, there is no manner to define that the user can't do create or
drop
> objects, but can create temp tables?
What we normally do is something like this.
create user dbowner password 'ownerpasswd';
create user db password 'normalpasswd';
create user dbviewer password 'viewerpasswd';
create database db with owner dbowner;
\c db
revoke create on database db from public;
revoke create on schema public from public;
grant create on schema public to dbowner;
set role dbowner;
<create objects>
Then we limit access to the given database to the appropriate users in
the pg_hba.conf file. The owner grants the desired rights to each
user.
I hope this helps.
-Kevin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: Kevin.Grittner@wicourts.gov, rafael.domiciano@gmail.com, tgl@sss.pgh.pa.us, milen@radev.net
Subject: Re: Revoke for a new role
In-Reply-To: <485A5758.EE98.0025.0@wicourts.gov>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox