From: Tomasz Myrta <jasiek@klaster.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: 'pgsql-sql@postgresql.org' <pgsql-sql@postgresql.org>
Subject: Re: function with security definer
Date: Mon, 24 Mar 2003 19:16:55 +0800
Message-ID: <20030324191655.M26247@klaster.net> (raw)
In-Reply-To: <12693.1048518122@sss.pgh.pa.us>
References: <3E7ED5EE.9090104@klaster.net>
<12693.1048518122@sss.pgh.pa.us>
> Tomasz Myrta <jasiek@klaster.net> writes:
> > [ Can't do SET SESSION AUTHORIZATION in a postgres-owned function ]
>
> That's because SET SESSION AUTHORIZATION looks to the original login
> userid, not the current effective userid, to decide whether you're
> allowed to do it. If it didn't work that way, a superuser couldn't
> switch to any other identity after becoming a nonprivileged user.
Does it mean, that SET SESSION AUTHORIZATION works the same for function
created with "security definer" as with "security invoker"? Are there any
other cases, when it doesn't work properly?
> I don't really see why you think this kluge is better than creating
> multiple database users, anyway ...
Well, it was just an idea. It is easier to keep all information about users
in one table "users" than synchronizing this table with pg_shadow via
usesysid and granting/revoking each user one by one (or adding them to
groups). It lets me also to give each user as little rights as needed - even
depending on which application they currently run (administration panel or
web report)
Regards,
Tomasz Myrta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: jasiek@klaster.net, tgl@sss.pgh.pa.us
Subject: Re: function with security definer
In-Reply-To: <20030324191655.M26247@klaster.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox