From: Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com>
To: sbob <sbob@quadratum-braccas.com>
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: Managing LDAP User permissions
Date: Thu, 20 Jul 2023 15:10:40 +0000
Message-ID: <e8a53062f73b47fb844075acda331c0a@express-scripts.com> (raw)
In-Reply-To: <4c4cd166-e852-c26d-992b-f1296c35135f@quadratum-braccas.com>
References: <4c4cd166-e852-c26d-992b-f1296c35135f@quadratum-braccas.com>
Removing user from ldap config will not remove from PG.
As Far As Best Practices, I have always Expired the password in PG and comment on that employee left. We still leave the user intact (with expired psswd) for any audit need.
Expiring the psswd also gives you an exact timestamp in the db when they were denied db access.
-----Original Message-----
From: sbob <sbob@quadratum-braccas.com>
Sent: Thursday, July 20, 2023 7:53 AM
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Subject: [EXTERNAL] Managing LDAP User permissions
All;
I know from the docs I can deploy LDAP authentication, one we do this how do we manage permissions within the database foe various LDAP users?
Can I setup automatic permissions based on LDAP groups?
Can we ensure that if an employee leaves then these permissions are automatically removed?
Is there a best practice for this?
Thanks in advance
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: Matthew.Wetmore@express-scripts.com, sbob@quadratum-braccas.com, pgsql-admin@lists.postgresql.org
Subject: Re: Managing LDAP User permissions
In-Reply-To: <e8a53062f73b47fb844075acda331c0a@express-scripts.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox