Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-06-03 Thread Stephen Frost
* Clark C. Evans (c...@clarkevans.com) wrote: > Yes, if we had per-database roles, it would work. However, I don't > think it's necessary. We've already got role permissions specific to > a database; so we're most of the way there. PG has two sets of catalogs, per-databases ones and 'shared' o

Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-05-29 Thread Clark C. Evans
On Wed, May 29, 2013, at 10:08 AM, Stephen Frost wrote: > This capability might well come with a real way to have per-database > roles in general, which has been asked for quite often as well. You > would then be able to have an 'auditor' role in each database and have > them actually be different

Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-05-29 Thread Clark C. Evans
On Wed, May 29, 2013, at 09:45 AM, Stephen Frost wrote: > * Albe Laurenz (laurenz.a...@wien.gv.at) wrote: > > Maybe the db_user_namespace parameter can help: > > http://www.postgresql.org/docs/9.2/static/runtime-config-connection.html#GUC-DB-USER-NAMESPACE > > I doubt it and I wouldn't encourage a

Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-05-29 Thread Stephen Frost
Clark, * Clark C. Evans (c...@clarkevans.com) wrote: > I apologize for posting to -hackers; it was probably the wrong list. I don't know about that.. It's a new feature request, not sure where else you'd email about it. That said, it's also a non-trivial thing to change and it would have to be

Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-05-29 Thread Stephen Frost
* Albe Laurenz (laurenz.a...@wien.gv.at) wrote: > Maybe the db_user_namespace parameter can help: > http://www.postgresql.org/docs/9.2/static/runtime-config-connection.html#GUC-DB-USER-NAMESPACE I doubt it and I wouldn't encourage anyone to use it even if it happened to help in this situation..

Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-05-29 Thread Albe Laurenz
Clark C. Evans wrote: >>> I'd really love the ability to grant a *user* >>> role-based privileges database by database. >> >> The only cluster-wide role permissions are the options >> SUPERUSER, CREATEDB, CREATEROLE, INHERIT, >> LOGIN and REPLICATION. > > Incorrect; role-to-role membership (differ

Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-05-29 Thread Clark C. Evans
On Wed, May 29, 2013, at 04:26 AM, Albe Laurenz wrote: > Clark C. Evans wrote: > > I'd really love the ability to grant a *user* > > role-based privileges database by database. > > The only cluster-wide role permissions are the options > SUPERUSER, CREATEDB, CREATEROLE, INHERIT, > LOGIN and REPLIC

Re: [HACKERS] GRANT role_name TO role_name ON database_name

2013-05-29 Thread Albe Laurenz
Clark C. Evans wrote: > I'd really love the ability to grant a *user* > role-based privileges database by database. > > For background, I have several databases running > in a single cluster, one database per business unit. > Each database has the same core schema with the same > basic role permis

[HACKERS] GRANT role_name TO role_name ON database_name

2013-05-28 Thread Clark C. Evans
I'd really love the ability to grant a *user* role-based privileges database by database. For background, I have several databases running in a single cluster, one database per business unit. Each database has the same core schema with the same basic role permissions, but with significant cu