pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedTemporarily disable a role
4+ messages / 3 participants
[nested] [flat]
* Temporarily disable a role
@ 2018-06-11 08:24 Yinjie Lin <exialin37@gmail.com>
0 siblings, 2 replies; 4+ messages in thread
From: Yinjie Lin @ 2018-06-11 08:24 UTC (permalink / raw)
To: pgsql-admin
Hello everyone.
I'm wondering if there is any way we could disable a role temporarily, and
enable it later.
For example, there are two users u1 and u2. User u1 grants the privileges
of its table t1 to role r1:
> grant all on t1 to r1;
Then, role r1 is granted to user u2:
> grant r1 to u2;
Now user u2 should have access to table t1. Here is my question: can we
disable role r1 so that user u2 will not have permissions on table t1? Note
that role r1 is not removed, so we can enable it later.
I expected ALTER ROLE would have some options dealing with this, but could
not find a proper way. Does anyone have ideas? Thanks in advance.
Best regards
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Temporarily disable a role
@ 2018-06-11 08:42 Ron <ronljohnsonjr@gmail.com>
parent: Yinjie Lin <exialin37@gmail.com>
1 sibling, 1 reply; 4+ messages in thread
From: Ron @ 2018-06-11 08:42 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
On 06/11/2018 03:24 AM, Yinjie Lin wrote:
> Hello everyone.
>
> I'm wondering if there is any way we could disable a role temporarily, and
> enable it later.
>
> For example, there are two users u1 and u2. User u1 grants the privileges
> of its table t1 to role r1:
>
> grant all on t1 to r1;
>
>
> Then, role r1 is granted to user u2:
>
> grant r1 to u2;
>
>
> Now user u2 should have access to table t1. Here is my question: can we
> disable role r1 so that user u2 will not have permissions on table t1?
> Note that role r1 is not removed, so we can enable it later.
>
> I expected ALTER ROLE would have some options dealing with this, but could
> not find a proper way. Does anyone have ideas? Thanks in advance.
Why not revoke r1 from u2?
--
Angular momentum makes the world go 'round.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Temporarily disable a role
@ 2018-06-11 08:45 Yinjie Lin <exialin37@gmail.com>
parent: Ron <ronljohnsonjr@gmail.com>
0 siblings, 0 replies; 4+ messages in thread
From: Yinjie Lin @ 2018-06-11 08:45 UTC (permalink / raw)
To: ronljohnsonjr@gmail.com; +Cc: pgsql-admin@lists.postgresql.org
Sorry I didn't describe my question clearly. Say that role r1 is granted
to many users, and I want to disable role r1 so that privileges granted to
these users are disabled at the same time. I don't want to call REVOKE for
each user, and it can prevent situations when I forget to call REVOKE for
some users.
Ron <ronljohnsonjr@gmail.com> 于2018年6月11日周一 下午4:43写道：
> On 06/11/2018 03:24 AM, Yinjie Lin wrote:
>
> Hello everyone.
>
> I'm wondering if there is any way we could disable a role temporarily, and
> enable it later.
>
> For example, there are two users u1 and u2. User u1 grants the privileges
> of its table t1 to role r1:
>
>> grant all on t1 to r1;
>
>
> Then, role r1 is granted to user u2:
>
>> grant r1 to u2;
>
>
> Now user u2 should have access to table t1. Here is my question: can we
> disable role r1 so that user u2 will not have permissions on table t1? Note
> that role r1 is not removed, so we can enable it later.
>
> I expected ALTER ROLE would have some options dealing with this, but could
> not find a proper way. Does anyone have ideas? Thanks in advance.
>
>
> Why not revoke r1 from u2?
>
> --
> Angular momentum makes the world go 'round.
>
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Temporarily disable a role
@ 2018-06-11 09:14 Stéphane KANSCHINE <stephane@hexack.fr>
parent: Yinjie Lin <exialin37@gmail.com>
1 sibling, 0 replies; 4+ messages in thread
From: Stéphane KANSCHINE @ 2018-06-11 09:14 UTC (permalink / raw)
To: Yinjie Lin <exialin37@gmail.com>; +Cc: pgsql-admin
Le lun. 11 juin, vers 16:24, Yinjie Lin exprimait :
> Hello everyone.
Hey !
> I'm wondering if there is any way we could disable a role temporarily, and
> enable it later.
Maybe you should create a group, add your grants to this group and create
users into this group. Then, when you want to "disable", you just have
to remove this from the group:
https://www.postgresql.org/docs/10/static/sql-creategroup.html
Regards,
--
Stéphane KANSCHINE - https://www.hexack.fr./ - https://www.nuajik.io./
＠ stephane@hexack.fr
+33 6 64 31 72 52
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2018-06-11 09:14 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2018-06-11 08:24 Temporarily disable a role Yinjie Lin <exialin37@gmail.com>
2018-06-11 08:42 ` Ron <ronljohnsonjr@gmail.com>
2018-06-11 08:45 ` Yinjie Lin <exialin37@gmail.com>
2018-06-11 09:14 ` Stéphane KANSCHINE <stephane@hexack.fr>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox