Re: [GENERAL] (Default) Group permissions

2013-07-03 Thread Michael Orlitzky
On 07/02/2013 03:35 AM, Albe Laurenz wrote: > Michael Orlitzky wrote: >> I want to be able to create a database, set up the (default) group >> permissions, and have them work, even when a new user is added to one of >> the groups. Right now I don't know of a way to get de

Re: [GENERAL] (Default) Group permissions

2013-07-01 Thread Michael Orlitzky
On 07/01/2013 10:21 AM, Andrew Sullivan wrote: > > So not "can do anything", but can read and write any database. Looks > to me to be something like > >CREATE ROLE adminuser NOSUPERUSER NOCREATEDB NOCREATEROLE >NOCREATEUSER INHERIT LOGIN NOREPLICATION ADMIN; > > Whenever a database is c

Re: [GENERAL] (Default) Group permissions

2013-07-01 Thread Michael Orlitzky
On 07/01/2013 03:36 AM, Albe Laurenz wrote: > > I took a look, but it takes more time than I'm willing to spend > to actually get to your problem. > > Could you outline briefly what the problem is? > (I'm going to copy from the README a bit, but I'll try to pare it down) I want to be able to c

Re: [GENERAL] (Default) Group permissions

2013-07-01 Thread Michael Orlitzky
On 06/30/2013 09:56 PM, Andrew Sullivan wrote: > On Sun, Jun 30, 2013 at 09:31:18PM -0400, Michael Orlitzky wrote: >> (why do I get the feeling nobody is going to check out the repo): > > Probably because you're asking random strangers on the Internet to > help you solve t

Re: [GENERAL] (Default) Group permissions

2013-06-30 Thread Michael Orlitzky
On 06/30/2013 09:12 PM, Andrew Sullivan wrote: > > If you want "easy", then just give different databases per user. If > you want complicated, you need an administrator; yes, that needs to be > in some sense under the control of the host. We have roughly 40 years > of experience with these thing

Re: [GENERAL] (Default) Group permissions

2013-06-30 Thread Michael Orlitzky
On 06/30/2013 08:45 PM, David Johnston wrote: > > So PostgreSQL is only useful, for shared hosting, when the only permissible > access is via vendor-supplied resources (APIs, administrators, etc...)? > I'm not sure I understand, but I don't think that's what I'm saying. I want my customers and c

Re: [GENERAL] (Default) Group permissions

2013-06-30 Thread Michael Orlitzky
On 06/30/2013 07:06 PM, John R Pierce wrote: > On 6/30/2013 12:46 PM, Michael Orlitzky wrote: >> We use Postgres for shared hosting; i.e. what most people use MySQL for. >> The biggest headache for us so far has been that we're unable to get >> group permissions

[GENERAL] (Default) Group permissions

2013-06-30 Thread Michael Orlitzky
We use Postgres for shared hosting; i.e. what most people use MySQL for. The biggest headache for us so far has been that we're unable to get group permissions set up effectively so that different groups of customers, admins, apaches, etc. can access/modify the data they need, without manual interv

Re: [GENERAL] State of the art re: group default privileges

2013-03-21 Thread Michael Orlitzky
On 03/21/2013 11:34 AM, Adrian Klaver wrote: > On 03/21/2013 07:52 AM, Michael Orlitzky wrote: >> On 03/21/2013 10:39 AM, Adrian Klaver wrote: >>>> >>>> This won't fly unfortunately. It's a shared host, and the "developers" >>>>

Re: [GENERAL] State of the art re: group default privileges

2013-03-21 Thread Michael Orlitzky
On 03/21/2013 10:39 AM, Adrian Klaver wrote: >> >> This won't fly unfortunately. It's a shared host, and the "developers" >> are a mixed bag of our employees, consultants, and the customer's employees. > > Do not follow. The set role= is put on a login role. It will only work > on those databases

Re: [GENERAL] State of the art re: group default privileges

2013-03-20 Thread Michael Orlitzky
On 03/20/2013 08:05 PM, Adrian Klaver wrote: >> >> Now everything in the database will be owned by dev_user. But what >> happens if we have 100 databases (this is realistic for us), and add a >> new developer a year down the road? I have to not only add him to >> dev_user, but look through each dat

Re: [GENERAL] State of the art re: group default privileges

2013-03-20 Thread Michael Orlitzky
On 03/20/2013 06:40 PM, Adrian Klaver wrote: > On 03/20/2013 03:26 PM, Michael Orlitzky wrote: >> On 03/20/2013 05:18 PM, Rob Sargent wrote: > >> >> At the moment, everyone's just experimenting. Even with the proper >> tooling, my blog app shouldn't

Re: [GENERAL] State of the art re: group default privileges

2013-03-20 Thread Michael Orlitzky
On 03/20/2013 05:18 PM, Rob Sargent wrote: > What's your process? First I've heard of a group of dev's ignorant of > permission _and_ trusted to change things in a db which affect others. It's a playground for a group of people. They want to be able to create stuff, and then modify that stuff. N

Re: [GENERAL] State of the art re: group default privileges

2013-03-20 Thread Michael Orlitzky
On 03/20/2013 04:12 PM, Alvaro Herrera wrote: > Michael Orlitzky wrote: >> I'm running into this exact situation: >> >> http://www.postgresql.org/message-id/CAG1_KcBFM0e2buUG=o7ojq_ktadrzdgd45ju7gke3duz0sz...@mail.gmail.com >> >> We really need to be able

[GENERAL] State of the art re: group default privileges

2013-03-20 Thread Michael Orlitzky
I'm running into this exact situation: http://www.postgresql.org/message-id/CAG1_KcBFM0e2buUG=o7ojq_ktadrzdgd45ju7gke3duz0sz...@mail.gmail.com We really need to be able to have a group of developers who can create things and modify each others' stuff[1]. Is it still more or less impossible? The