agora inbox for pgsql-sql@postgresql.org
help / color / mirror / Atom feedFrom: Tim Dudgeon <tdudgeon.ml@gmail.com>
To: pgsql-sql@postgresql.org
Subject: question on row level security
Date: Wed, 30 Dec 2015 16:58:02 +0000
Message-ID: <56840D1A.8030203@gmail.com> (raw)
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-sql>
The new row level security feature in 9.5 looks great.
I guess its designed around the need to restrict access based on the
current database user (current_user) where this maps to a database user.
But most applications now access the database using an application user
and manages data for the applications multiple users (probably with each
user being a row in a USERS table somewhere).
Is there any way to "inject" the application user so that this can be
used in a RLS check?
e.g. conceptually:
set app_user 'john';
select * from foo;
where the select * is restricted by a RLS check that includes 'john' as
the app_user.
Of course custom SQL could be generated for this, but it would be safer
if it could be handled using RLS.
Any ways to do this?
Tim
--
Sent via pgsql-sql mailing list (pgsql-sql@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-sql
view thread (8+ messages) latest in thread
Message-ID: <56840D1A.8030203@gmail.com>
Permalink: ../56840D1A.8030203@gmail.com/
Also on: postgresql.org/message-id/56840D1A.8030203@gmail.com
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tdudgeon.ml@gmail.com
Subject: Re: question on row level security
In-Reply-To: <56840D1A.8030203@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox