[prev in list] [next in list] [prev in thread] [next in thread] 

List:       postgresql-general
Subject:    Re: [GENERAL] Data access permission?
From:       Richard Huxton <dev () archonet ! com>
Date:       2001-03-31 7:16:21
[Download RAW message or body]

Pluto wrote:
> Can PostgreSQL, MySQL or other database programs can allow some user to
> access some specific data while other data is prohibited to them in a
> same database? If so, how to implement that? For instance, a client can

Check the GRANT and REVOKE commands. This will give you table-level
access control.

> print last month's statement through the Internet by providing a
> password to him/her; this client can only check the data that belong to
> him/her, at the meantime, there is other clients' data in the same
> database. Thanks for your kind help!

If the data is in the same table, create two views (see CREATE VIEW) to
control what data can be seen. Grant permission to the view required and
revoke permissions on the underlying table.

You can of course also apply controls in your application, and it might
be an idea to do both (security in depth).

There's more in Bruce's book (link to the online version from
www.postgresql.org) and my notes at techdocs.postgresql.org

- Richard Huxton

---------------------------(end of broadcast)---------------------------
TIP 4: Don't 'kill -9' the postmaster

[prev in list] [next in list] [prev in thread] [next in thread]