X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by svr1.postgresql.org (Postfix) with ESMTP id 41C6BDB371 for ; Thu, 10 Nov 2005 18:07:18 -0400 (AST) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 65641-08 for ; Thu, 10 Nov 2005 22:07:13 +0000 (GMT) X-Greylist: delayed 01:49:17.775374 by SQLgrey- Received: from svr2.postgresql.org (svr2.postgresql.org [65.19.161.25]) by svr1.postgresql.org (Postfix) with ESMTP id 36297DB2E1 for ; Thu, 10 Nov 2005 18:07:10 -0400 (AST) Received: from svctag-ckgvz71.mailserver.wazagua.com (unknown [209.34.245.244]) by svr2.postgresql.org (Postfix) with ESMTP id 3A31BF0FE9 for ; Thu, 10 Nov 2005 20:17:55 +0000 (GMT) Received: from jfradkin ([66.15.127.235]) by svctag-ckgvz71.mailserver.wazagua.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 10 Nov 2005 15:18:36 -0500 From: "Joel Fradkin" To: Subject: High level discussion for design of using ACL to retrieve Data Date: Thu, 10 Nov 2005 15:19:01 -0500 Message-ID: <00c901c5e633$fdb14160$797ba8c0@jfradkin> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00CA_01C5E60A.14DB3960" X-OriginalArrivalTime: 10 Nov 2005 20:18:37.0125 (UTC) FILETIME=[EEA21F50:01C5E633] X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=4.077 required=5 tests=[AWL=-1.327, HTML_MESSAGE=0.001, MSGID_DOLLARS=2.163, RATWARE_MS_HASH=1.379, RATWARE_OUTLOOK_NONAME=1.861] X-Spam-Score: 4.077 X-Spam-Level: **** X-Archive-Number: 200511/99 X-Sequence-Number: 23350 This is a multi-part message in MIME format. ------=_NextPart_000_00CA_01C5E60A.14DB3960 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit We currently use a system with 4 tables (division, region, district, location). The data for the most part has a field named location id. The users get a level and location id (if they are district it would represent a district id etc). I have been asked to make this more flexible, for example if the user needs data for two locations but they are not in the same district. One thing I have had to add was the ability to have a user have access to a location and then also have access to a related location (main and auto center have different location number, but if the user has access to the main location he can also see auto center data). I did this with a xref table and a union, but it seem pretty slow. So adding even more flexibity like multiple districts, locs etc (was thinking of trying to do some kind of grouping that would encompass our current plan) has been a problem I have thought about a lot, but I have not figured out a way that will give fast access. I could do groups of access rights and do unions with distinct to get data, but I fear that would be really slow. Any one have ideas on this subject? Thanks in advance. Joel Fradkin ------=_NextPart_000_00CA_01C5E60A.14DB3960 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

We currently use a system with 4 tables (division, = region, district, location).

The data for the most part has a field named location = id.

The users get a level and location id (if they are = district it would represent a district id etc).

I have been asked to make this more flexible, for = example if the user needs data for two locations but they are not in the same = district.

One thing I have had to add was the ability to have a = user have access to a location and then also have access to a related = location (main and auto center have different location number, but if the user has = access to the main location he can also see auto center data).

I did this with a xref table and a union, but it seem = pretty slow.

So adding even more flexibity like multiple = districts, locs etc (was thinking of trying to do some kind of grouping that would = encompass our current plan) has been a problem I have thought about a lot, but I = have not figured out a way that will give fast access.

I could do groups of access rights and do unions with distinct to get data, but I fear that would be really = slow.

Any one have ideas on this subject?

Thanks in advance.

Joel Fradkin

------=_NextPart_000_00CA_01C5E60A.14DB3960--