
Comming from Oracle, I was disapointed that
the users were not "per individual database".

I had to promote my database owner to superuser
to make it able to create users (I didn't want
to su to postgres for user creation).

Is there any chance that this will change in
the future ?


Regarding privileges, I was also disapointed to
see that the object owner rights (ALL) had to
be stored when grants where made on those objects
to other users. I rememeber reading something
about changes in privileges storing.

Is there a change regarding this in the TODO list ?


Best regards,

Jean-Francois Leveque


______________________________________________________________________
Sur WebMailS.com, mon adresse de courrier �lectronique gratuite.
Service multilingue, s�r, et permanent. http://www.webmails.com/

Fri, 6 Jul 2001 10:37:50 +0100
"Jean-Francois Leveque" <leveque@webmails.com>
Database Users Management and Privileges
Jean-Francois Leveque writes:

> Comming from Oracle, I was disapointed that
> the users were not "per individual database".

> Is there any chance that this will change in
> the future ?

Most likely not.  For one thing, it would be a problem to assign owners to
databases.

> Regarding privileges, I was also disapointed to
> see that the object owner rights (ALL) had to
> be stored when grants where made on those objects
> to other users. I rememeber reading something
> about changes in privileges storing.

This has been corrected in 7.1.

-- 
Peter Eisentraut   peter_e@gmx.net   http://funkturm.homeip.net/~peter


Fri, 6 Jul 2001 16:17:04 +0200 (CEST)
Peter Eisentraut <peter_e@gmx.net>
Re: Database Users Management and Privileges
* Peter Eisentraut <peter_e@gmx.net> wrote:
|
| Jean-Francois Leveque writes:
| 
| > Comming from Oracle, I was disapointed that
| > the users were not "per individual database".
| 
| > Is there any chance that this will change in
| > the future ?
| 
| Most likely not.  For one thing, it would be a problem to assign owners to
| databases.
| 

Why ? Better user management and policy delegations would be important
postgresql to succeed in enterprise environments. Maybe one should 
start distinguishing logins from users like Sybase does. Logins are global
to all databases, and you can create a user for a given database and assign
it to a login. It would also be nice to be able to assign users to 
groups(which in turn define access rights within the database). 

regards,

        Gunnar

-- 
Gunnar Rï¿½nning - gunnar@polygnosis.com
Senior Consultant, Polygnosis AS, http://www.polygnosis.com/

06 Jul 2001 17:08:05 +0200
Gunnar =?iso-8859-1?q?R=F8nning?= <gunnar@polygnosis.com>
Re: Database Users Management and Privileges
Gunnar Rï¿½nning writes:

> Better user management and policy delegations would be important
> postgresql to succeed in enterprise environments.

Keeping compatibility is also important.

> Maybe one should
> start distinguishing logins from users like Sybase does. Logins are global
> to all databases, and you can create a user for a given database and assign
> it to a login.

That doesn't strike me as terribly better.  Operating system
administrators tend to unify user management across the whole network.
You're essentially suggesting making separate users per file system.
Ugh.

> It would also be nice to be able to assign users to
> groups(which in turn define access rights within the database).

That would indeed be nice.  That's why we have already implemented it.

-- 
Peter Eisentraut   peter_e@gmx.net   http://funkturm.homeip.net/~peter


Fri, 6 Jul 2001 17:41:23 +0200 (CEST)
Peter Eisentraut <peter_e@gmx.net>
Re: Database Users Management and Privileges
* Peter Eisentraut <peter_e@gmx.net> wrote:

| > Better user management and policy delegations would be important
| > postgresql to succeed in enterprise environments.
| 
| Keeping compatibility is also important.

Well nobody said you can't get both ;-)

| > to all databases, and you can create a user for a given database and assign
| > it to a login.
| 
| That doesn't strike me as terribly better.  Operating system
| administrators tend to unify user management across the whole network.
| You're essentially suggesting making separate users per file system.
| Ugh.

Well, it is important for some networks to have the ability to create users 
local to a subset of the network. Let the sub networks manage themselves. 
Matter of policy of course.

| > It would also be nice to be able to assign users to
| > groups(which in turn define access rights within the database).
| 
| That would indeed be nice.  That's why we have already implemented it.

Oops, sorry. RTFM.... But the set of permissions you can assign to a group is
fairly limited. E.g. I can't see that you are able to grant a user/group 
create/drop table permissions for a database. Does that mean any user can 
create/drop tables ? I think this is an example of a permission a DBA would 
like to grant to users per database. 

createuser/createdb are rights assigned to a user directly. Wouldn't it make 
sense to be able to assign these rights to a group of users ?

regards, 

        Gunnar

-- 
Gunnar Rï¿½nning - gunnar@polygnosis.com
Senior Consultant, Polygnosis AS, http://www.polygnosis.com/

06 Jul 2001 20:53:05 +0200
Gunnar =?iso-8859-1?q?R=F8nning?= <gunnar@polygnosis.com>
Re: Database Users Management and Privileges