agora inbox for pgsql-sql@postgresql.org  

help / color / mirror / Atom feed

From: Adrian Klaver <adrian.klaver@aklaver.com>
To: Tim Dudgeon <tdudgeon.ml@gmail.com>
To: pgsql-sql@postgresql.org
Subject: Re: question on row level security
Date: Wed, 30 Dec 2015 09:28:31 -0800
Message-ID: <5684143F.1010205@aklaver.com> (raw)
In-Reply-To: <56840D1A.8030203@gmail.com>
References: <56840D1A.8030203@gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-sql>

On 12/30/2015 08:58 AM, Tim Dudgeon wrote:
> The new row level security feature in 9.5 looks great.
> I guess its designed around the need to restrict access based on the
> current database user (current_user) where this maps to a database user.
> But most applications now access the database using an application user
> and manages data for the applications multiple users (probably with each
> user being a row in a USERS table somewhere).
> Is there any way to "inject" the application user so that this can be
> used in a RLS check?
> e.g. conceptually:
>
> set app_user 'john';
> select * from foo;
>
> where the select * is restricted by a RLS check that includes 'john' as
> the app_user.
> Of course custom SQL could be generated for this, but it would be safer
> if it could be handled using RLS.
>
> Any ways to do this?

User name maps?:

http://www.postgresql.org/docs/9.5/interactive/auth-username-maps.html

This still results in an external user becoming a database user. From 
there you can set up users as members of larger roles, i.e accounting, 
hr, etc to manage access, or not.

>
> Tim
>
>
>


-- 
Adrian Klaver
adrian.klaver@aklaver.com


-- 
Sent via pgsql-sql mailing list (pgsql-sql@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-sql

view thread (8+ messages)  latest in thread

Message-ID: <5684143F.1010205@aklaver.com>
Permalink:  ../5684143F.1010205@aklaver.com/
Also on:    postgresql.org/message-id/5684143F.1010205@aklaver.com

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: adrian.klaver@aklaver.com, tdudgeon.ml@gmail.com
  Subject: Re: question on row level security
  In-Reply-To: <5684143F.1010205@aklaver.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox