Re: Postgresql + digital signature

On 1/23/08, Luis Alberto Pérez Paz <midriasis@gmail.com> wrote:
> Very interesting point of view.
> Yes, you're right about the manage key problem.
>
> The grant database access looks like a real solution.

Eh, for some reason I imagined you have have some good reason
why simple solutions are not enough...


Btw, if you try to simply rrestrict access to your data, one good
way for that is to make all data access and modification go via
SECURITY DEFINER functions, so that user have no access to
underlying data tables.

This gives both more flexible access handling than simple GRANTs
can give you and also give ability to do smooth schema upgrades
without applications noticing.

--
marko