From: Jasen Betts <jasen@xnet.co.nz>
To: pgsql-sql@postgresql.org
Subject: Re: PostgreSQL Security/Roles/Grants
Date: 2 Nov 2009 10:11:23 GMT
Message-ID: <hcmb8b$3rg$3@reversiblemaps.ath.cx> (raw)
References: <COL122-W3402F3A4C1F2DF3A50ECC5CDB40@phx.gbl>
On 2009-11-01, Andrew Hall <andrewah@hotmail.com> wrote:
> 1. Default Roles -> a role which is activated at login time. Oracle imposes=
> a limit on the number of default roles which any given user can have.
>
> 2. Non-default role -> a role which has to be explicitly activated during t=
> he lifecycle of an application in order to gain access to database resource=
> s. There are no limits on the number of non-default roles. This type of rol=
> e helps us to only provide a user with the minimal set of privileges that t=
> hey require at any given time=2C and minimise their access to database reso=
> urces.
the only way I know of to provide anything like non-default roles is
via functions declared with "security definer"
> Secondly=2C is there a limit on the number of roles which can be assigned t=
> o a user (or more accurately a 'login role') in postgreSQL?
no (2^16 maybe??) IIRC you do hit an complexity limit, O(n^2) or worse.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: jasen@xnet.co.nz
Subject: Re: PostgreSQL Security/Roles/Grants
In-Reply-To: <hcmb8b$3rg$3@reversiblemaps.ath.cx>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox