Обсуждение: select only user

Поиск
Список
Период
Сортировка

select only user

От
Jessica Richard
Дата:
I created a user and granted only "select" to this user so that  this user can only select the tables on a production system. But by default, this user can also CREATE TABLE successfully....

How can I revoke this "create table" privilege (and possible others) and limit this user to only the permissions granted by me?

Thanks,
Jessica


Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

Re: select only user

От
"Milen A. Radev"
Дата:
Jessica Richard написа:
> I created a user and granted only "select" to this user so that  this user can only select the tables on a production
system.But by default, this user can also CREATE TABLE successfully.... 
>
> How can I revoke this "create table" privilege (and possible others) and limit this user to only the permissions
grantedby me? 
>

Revoke the "create" privilege on the "public" schema (or any other
schema you've created) from 'public' (that's special "role"). Also
revoke the "create" privilege on the database(s) in question from the
same special role 'public' to prevent creation of new schemas.

More here - http://www.postgresql.org/docs/current/static/sql-grant.html.

--
Milen A. Radev

Re: select only user

От
"Milen A. Radev"
Дата:
Milen A. Radev написа:
> Jessica Richard написа:
>> I created a user and granted only "select" to this user so that  this
>> user can only select the tables on a production system. But by
>> default, this user can also CREATE TABLE successfully....
>>
>> How can I revoke this "create table" privilege (and possible others)
>> and limit this user to only the permissions granted by me?
>>
>
> Revoke the "create" privilege on the "public" schema (or any other
> schema you've created) from 'public' (that's special "role"). Also
> revoke the "create" privilege on the database(s) in question from the
> same special role 'public' to prevent creation of new schemas.
>
> More here - http://www.postgresql.org/docs/current/static/sql-grant.html.

Almost forgot - there is another way if the role in question would be
read-only:

ALTER USER username SET default_transaction_read_only to true;

(http://archives.postgresql.org/pgsql-admin/2007-10/msg00101.php)




--
Milen A. Radev

Re: select only user

От
Jessica Richard
Дата:
Thanks!!!
"ALTER USER username SET default_transaction_read_only to true" worked.

One more question:

where do I see the current setting of "default_transacton_read_only (true for false) for each user on the system? Is there a table that keeps this kind of info for all users?

Thanks again,
Jessica

"Milen A. Radev" <milen@radev.net> wrote:
Milen A. Radev написа:
> Jessica Richard написа:
>> I created a user and granted only "select" to this user so that this
>> user can only select the tables on a production system. But by
>> default, this user can also CREATE TABLE successfully....
>>
>> How can I revoke this "create table" privilege (and possible others)
>> and limit this user to only the permissions granted by me?
>>
>
> Revoke the "create" privilege on the "public" schema (or any other
> schema you've created) from 'public' (that's special "role"). Also
> revoke the "create" privilege on the database(s) in question from the
> same special role 'public' to prevent creation of new schemas.
>
> More here - http://www.postgresql.org/docs/current/static/sql-grant.html.

Almost forgot - there is another way if the role in question would be
read-only:

ALTER USER username SET default_transaction_read_only to true;

(http://archives.postgresql.org/pgsql-admin/2007-10/msg00101.php)




--
Milen A. Radev


---------------------------(end of broadcast)---------------------------
TIP 7: You can help support the PostgreSQL project by donating at

http://www.postgresql.org/about/donate


Looking for last minute shopping deals? Find them fast with Yahoo! Search.

Re: select only user

От
"Milen A. Radev"
Дата:
Jessica Richard написа:
> Thanks!!!
> "ALTER USER username SET default_transaction_read_only to true" worked.
>
> One more question:
>
> where do I see the current setting of "default_transacton_read_only (true for false) for each user on the system? Is
therea table that keeps this kind of info for all users? 
[...]


SELECT * FROM pg_roles where rolname = '<username>';


-[ RECORD 1 ]-+-------------------------------------
rolname       | <username>
rolsuper      | f
rolinherit    | t
rolcreaterole | f
rolcreatedb   | f
rolcatupdate  | f
rolcanlogin   | t
rolconnlimit  | -1
rolpassword   | ********
rolvaliduntil |
rolconfig     | {default_transaction_read_only=true}
oid           | 53531114


(http://www.postgresql.org/docs/current/static/database-roles.html)



--
Milen A. Radev