pg.ddx.io pgsql-admin@postgresql.org mailing list archivehelp / color / mirror / Atom feed
Managing LDAP User permissions 3+ messages / 3 participants [nested] [flat]
* Managing LDAP User permissions @ 2023-07-20 14:52 sbob <sbob@quadratum-braccas.com> 0 siblings, 1 reply; 3+ messages in thread From: sbob @ 2023-07-20 14:52 UTC (permalink / raw) To: Pgsql-admin <pgsql-admin@lists.postgresql.org> All; I know from the docs I can deploy LDAP authentication, one we do this how do we manage permissions within the database foe various LDAP users? Can I setup automatic permissions based on LDAP groups? Can we ensure that if an employee leaves then these permissions are automatically removed? Is there a best practice for this? Thanks in advance ^ permalink raw reply [nested|flat] 3+ messages in thread
* Managing LDAP User permissions @ 2023-07-20 15:10 Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com> parent: sbob <sbob@quadratum-braccas.com> 0 siblings, 1 reply; 3+ messages in thread From: Wetmore, Matthew (CTR) @ 2023-07-20 15:10 UTC (permalink / raw) To: sbob <sbob@quadratum-braccas.com>; Pgsql-admin <pgsql-admin@lists.postgresql.org> Removing user from ldap config will not remove from PG. As Far As Best Practices, I have always Expired the password in PG and comment on that employee left. We still leave the user intact (with expired psswd) for any audit need. Expiring the psswd also gives you an exact timestamp in the db when they were denied db access. -----Original Message----- From: sbob <sbob@quadratum-braccas.com> Sent: Thursday, July 20, 2023 7:53 AM To: Pgsql-admin <pgsql-admin@lists.postgresql.org> Subject: [EXTERNAL] Managing LDAP User permissions All; I know from the docs I can deploy LDAP authentication, one we do this how do we manage permissions within the database foe various LDAP users? Can I setup automatic permissions based on LDAP groups? Can we ensure that if an employee leaves then these permissions are automatically removed? Is there a best practice for this? Thanks in advance ^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Managing LDAP User permissions @ 2023-07-20 15:12 M Sarwar <sarwarmd02@outlook.com> parent: Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com> 0 siblings, 0 replies; 3+ messages in thread From: M Sarwar @ 2023-07-20 15:12 UTC (permalink / raw) To: Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com>; sbob <sbob@quadratum-braccas.com>; Pgsql-admin <pgsql-admin@lists.postgresql.org> That is approach adopted by my previous federal client when an employee or contractor rolls out of the project. Thanks, Sarwar ________________________________ From: Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com> Sent: Thursday, July 20, 2023 11:10 AM To: sbob <sbob@quadratum-braccas.com>; Pgsql-admin <pgsql-admin@lists.postgresql.org> Subject: Managing LDAP User permissions Removing user from ldap config will not remove from PG. As Far As Best Practices, I have always Expired the password in PG and comment on that employee left. We still leave the user intact (with expired psswd) for any audit need. Expiring the psswd also gives you an exact timestamp in the db when they were denied db access. -----Original Message----- From: sbob <sbob@quadratum-braccas.com> Sent: Thursday, July 20, 2023 7:53 AM To: Pgsql-admin <pgsql-admin@lists.postgresql.org> Subject: [EXTERNAL] Managing LDAP User permissions All; I know from the docs I can deploy LDAP authentication, one we do this how do we manage permissions within the database foe various LDAP users? Can I setup automatic permissions based on LDAP groups? Can we ensure that if an employee leaves then these permissions are automatically removed? Is there a best practice for this? Thanks in advance ^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2023-07-20 15:12 UTC | newest] Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2023-07-20 14:52 Managing LDAP User permissions sbob <sbob@quadratum-braccas.com> 2023-07-20 15:10 ` Wetmore, Matthew (CTR) <Matthew.Wetmore@express-scripts.com> 2023-07-20 15:12 ` M Sarwar <sarwarmd02@outlook.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox