Received: from localhost (unknown [200.46.208.211]) by mail.postgresql.org (Postfix) with ESMTP id EAFCE63587A for ; Mon, 2 Nov 2009 06:26:53 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.208.211]) (amavisd-maia, port 10024) with ESMTP id 16714-04-2 for ; Mon, 2 Nov 2009 10:26:38 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from ananke.wxnz.net (ananke.wxnz.net [58.28.4.122]) by mail.postgresql.org (Postfix) with ESMTP id AB915907CD5 for ; Mon, 2 Nov 2009 06:10:33 -0400 (AST) Received: from gonzo (ip-118-90-134-179.xdsl.xnet.co.nz [118.90.134.179]) by ananke.wxnz.net (Postfix) with ESMTP id 5957417051A for ; Mon, 2 Nov 2009 23:10:30 +1300 (NZDT) Received: from news by gonzo with local (Exim 4.69) (envelope-from ) id 1N4tsi-0001Dz-5j for pgsql-sql@postgresql.org; Mon, 02 Nov 2009 23:11:24 +1300 To: pgsql-sql@postgresql.org Path: not-for-mail From: Jasen Betts Newsgroups: gmane.comp.db.postgresql.sql Subject: Re: PostgreSQL Security/Roles/Grants Date: 2 Nov 2009 10:11:23 GMT Organization: Dis (not Dat) Organisation Lines: 19 Message-ID: References: NNTP-Posting-Host: localhost Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Trace: reversiblemaps.ath.cx 1257156683 3952 127.0.0.1 (2 Nov 2009 10:11:23 GMT) X-Face: ?)Aw4rXwN5u0~$nqKj`xPz>xHCwgi^q+^?Ri*+R(&uv2=E1Q0Zk(>h!~o2ID@6{uf8s; a +M[5[U[QT7xFN%^gR"=tuJw%TXXR'Fp~W; (T"1(739R%m0Yyyv*gkGoPA.$b,D.w:z+<'"=-lVT?6 {T?=R^:W5g|E2#EhjKCa+nt":4b}dU7GYB*HBxn&Td$@f%.kl^:7X8rQWd[NTc"P"u6nkisze/Q; 8 "9Z{peQF,w)7UjV$c|RO/mQW/NMgWfr5*$-Z%u46"/00mx-,\R'fLPe.)^ User-Agent: slrn/pre1.0.0-2 (Linux) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-0.518 tagged_above=-10 required=5 tests=AWL=-0.519, BAYES_50=0.001 X-Spam-Level: X-Archive-Number: 200911/3 X-Sequence-Number: 33354 On 2009-11-01, Andrew Hall wrote: > 1. Default Roles -> a role which is activated at login time. Oracle imposes= > a limit on the number of default roles which any given user can have. > > 2. Non-default role -> a role which has to be explicitly activated during t= > he lifecycle of an application in order to gain access to database resource= > s. There are no limits on the number of non-default roles. This type of rol= > e helps us to only provide a user with the minimal set of privileges that t= > hey require at any given time=2C and minimise their access to database reso= > urces. the only way I know of to provide anything like non-default roles is via functions declared with "security definer" > Secondly=2C is there a limit on the number of roles which can be assigned t= > o a user (or more accurately a 'login role') in postgreSQL? no (2^16 maybe??) IIRC you do hit an complexity limit, O(n^2) or worse.