Date: Sun, 1 Nov 2009 14:09:59 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Andrew Hall <andrewah@hotmail.com>
Cc: PostgreSQL Mailing List <pgsql-sql@postgresql.org>
Subject: Re: PostgreSQL Security/Roles/Grants
Message-ID: <20091101190959.GD17756@tamriel.snowman.net>
References: <COL122-W3402F3A4C1F2DF3A50ECC5CDB40@phx.gbl>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="5asni2pzAWIbIUvo"
Content-Disposition: inline
In-Reply-To: <COL122-W3402F3A4C1F2DF3A50ECC5CDB40@phx.gbl>
User-Agent: Mutt/1.5.18 (2008-05-17)


--5asni2pzAWIbIUvo
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Andrew,

* Andrew Hall (andrewah@hotmail.com) wrote:
> 2. Non-default role -> a role which has to be explicitly activated during=
 the lifecycle of an application in order to gain access to database resour=
ces. There are no limits on the number of non-default roles. This type of r=
ole helps us to only provide a user with the minimal set of privileges that=
 they require at any given time, and minimise their access to database reso=
urces.
>=20
> I have looked through the PostgreSQL documentation, and cannot find anyth=
ing analogous to the 'non-default role' which I have outlined above - altho=
ugh obviously it does support roles.
>=20
> I just want to confirm that all roles in postgreSQL are activated at logi=
n time?

No.  You need to read the documentation on the 'noinherit' attribute of
roles.

See:

http://www.postgresql.org/docs/8.4/static/role-membership.html

> Secondly, is there a limit on the number of roles which can be assigned t=
o a user (or more accurately a 'login role') in postgreSQL?

No.

	Thanks,

		Stephen

--5asni2pzAWIbIUvo
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkrt3QcACgkQrzgMPqB3kijf9QCeLYBLMR5U2gRIsus8SmuDi2q9
NdEAn3ZS5PZ07J1uorZDR+Ss8m8ARu4c
=wm4i
-----END PGP SIGNATURE-----

--5asni2pzAWIbIUvo--