To: pgsql-sql@postgresql.org
From: Tim Dudgeon <tdudgeon.ml@gmail.com>
Subject: question on row level security
Message-ID: <56840D1A.8030203@gmail.com>
Date: Wed, 30 Dec 2015 16:58:02 +0000
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0)
 Gecko/20100101 Thunderbird/38.5.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
Sender: pgsql-sql-owner@postgresql.org

The new row level security feature in 9.5 looks great.
I guess its designed around the need to restrict access based on the 
current database user (current_user) where this maps to a database user.
But most applications now access the database using an application user 
and manages data for the applications multiple users (probably with each 
user being a row in a USERS table somewhere).
Is there any way to "inject" the application user so that this can be 
used in a RLS check?
e.g. conceptually:

set app_user 'john';
select * from foo;

where the select * is restricted by a RLS check that includes 'john' as 
the app_user.
Of course custom SQL could be generated for this, but it would be safer 
if it could be handled using RLS.

Any ways to do this?

Tim


-- 
Sent via pgsql-sql mailing list (pgsql-sql@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-sql